@elastic/schemas 0.5.0 → 0.5.1

package/src/kibana/json/security-attack-discovery-api.post-attack-discovery-generations-dismiss.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryGenerationsDismiss","x-api":{"id":"security-attack-discovery-api.post-attack-discovery-generations-dismiss","name":"post-attack-discovery-generations-dismiss","namespace":"security-attack-discovery-api"},"type":"object","properties":{"alerts_context_count":{"type":"number","description":"The number of alerts that were sent as context to the LLM for this generation."},"connector_id":{"type":"string","description":"The unique identifier of the connector used to generate the attack discoveries."},"connector_stats":{"type":"object","properties":{"average_successful_duration_nanoseconds":{"type":"number","description":"The average duration in nanoseconds for successful generations using this connector by the current user."},"successful_generations":{"type":"number","description":"The total number of Attack discoveries successfully created for this generation"}},"description":"Statistical information about the connector's performance for this user, providing insights into usage patterns and success rates."},"discoveries":{"type":"number","description":"The number of attack discoveries that were generated during this execution."},"end":{"type":"string","description":"The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven't finished."},"execution_uuid":{"type":"string","description":"The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls."},"loading_message":{"type":"string","description":"A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing."},"reason":{"type":"string","description":"Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process."},"start":{"type":"string","description":"The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis."},"status":{"enum":["canceled","dismissed","failed","started","succeeded"],"description":"The current status of the attack discovery generation. After dismissing, this will be set to \"dismissed\"."}},"required":["connector_id","discoveries","execution_uuid","loading_message","start","status"]}

package/src/kibana/json/security-attack-discovery-api.update-attack-discovery-schedules.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"UpdateAttackDiscoverySchedules","x-api":{"id":"security-attack-discovery-api.update-attack-discovery-schedules","name":"update-attack-discovery-schedules","namespace":"security-attack-discovery-api"},"x-method":"PUT","x-path":"/api/attack_discovery/schedules/{id}","x-destructive":true,"type":"object","properties":{"id":{"type":"string","description":"The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.","x-found-in":"path"},"body":{"$ref":"./_defs.json#/$defs/Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps","x-found-in":"body","x-body-root":true}},"required":["id"]}

package/src/kibana/json/security-attack-discovery-api.update-attack-discovery-schedules.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"UpdateAttackDiscoverySchedules","x-api":{"id":"security-attack-discovery-api.update-attack-discovery-schedules","name":"update-attack-discovery-schedules","namespace":"security-attack-discovery-api"},"$ref":"./_defs.json#/$defs/Security_Attack_discovery_API_AttackDiscoveryApiSchedule"}

package/src/kibana/json/security-detections-api.create-rule.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateRule","x-api":{"id":"security-detections-api.create-rule","name":"create-rule","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/rules","x-destructive":false,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleCreateProps","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.create-rule.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateRule","x-api":{"id":"security-detections-api.create-rule","name":"create-rule","namespace":"security-detections-api"},"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse"}

package/src/kibana/json/security-detections-api.delete-rule.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"DeleteRule","x-api":{"id":"security-detections-api.delete-rule","name":"delete-rule","namespace":"security-detections-api"},"x-method":"DELETE","x-path":"/api/detection_engine/rules","x-destructive":true,"type":"object","properties":{"id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_UUID","description":"The rule's `id` value.","x-found-in":"query"},"rule_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleSignatureId","description":"The rule's `rule_id` value.","x-found-in":"query"}}}

package/src/kibana/json/security-detections-api.delete-rule.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"DeleteRule","x-api":{"id":"security-detections-api.delete-rule","name":"delete-rule","namespace":"security-detections-api"},"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse"}

package/src/kibana/json/security-detections-api.export-rules.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ExportRules","x-api":{"id":"security-detections-api.export-rules","name":"export-rules","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/rules/_export","x-destructive":true,"x-response-type":"ndjson","type":"object","properties":{"exclude_export_details":{"type":"boolean","description":"Determines whether a summary of the exported rules is returned.","x-found-in":"query"},"file_name":{"type":"string","description":"File name for saving the exported rules.\n> info\n> When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.\n","x-found-in":"query"},"body":{"oneOf":[{"type":"object","properties":{"objects":{"type":"array","items":{"type":"object","properties":{"rule_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleSignatureId"}},"required":["rule_id"]},"description":"Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified."}},"required":["objects"]},{"type":"null"}],"x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.export-rules.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ExportRules","x-api":{"id":"security-detections-api.export-rules","name":"export-rules","namespace":"security-detections-api"},"type":"object","properties":{}}

package/src/kibana/json/security-detections-api.find-rules.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"FindRules","x-api":{"id":"security-detections-api.find-rules","name":"find-rules","namespace":"security-detections-api"},"x-method":"GET","x-path":"/api/detection_engine/rules/_find","x-destructive":false,"type":"object","properties":{"fields":{"type":"array","items":{"type":"string"},"description":"List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).\nIf omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or\nuse comma-separated values when supported by your client.\n","x-found-in":"query"},"filter":{"type":"string","description":"Search query\n\nFilters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:\n- name\n- enabled\n- tags\n- createdBy\n- interval\n- updatedBy\n> info\n> Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.\n","x-found-in":"query"},"sort_field":{"$ref":"./_defs.json#/$defs/Security_Detections_API_FindRulesSortField","description":"Field to sort by","x-found-in":"query"},"sort_order":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SortOrder","description":"Sort order","x-found-in":"query"},"page":{"type":"number","description":"Page number","x-found-in":"query"},"per_page":{"type":"number","description":"Rules per page","x-found-in":"query"},"gaps_range_start":{"type":"string","description":"Gaps range start","x-found-in":"query"},"gaps_range_end":{"type":"string","description":"Gaps range end","x-found-in":"query"},"gap_fill_statuses":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_GapFillStatus"},"description":"Gap fill statuses","x-found-in":"query"},"gap_auto_fill_scheduler_id":{"type":"string","description":"Gap auto fill scheduler ID used to determine gap fill status for rules","x-found-in":"query"}}}

package/src/kibana/json/security-detections-api.find-rules.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"FindRules","x-api":{"id":"security-detections-api.find-rules","name":"find-rules","namespace":"security-detections-api"},"type":"object","properties":{"data":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse"}},"page":{"type":"number"},"perPage":{"type":"number"},"total":{"type":"number"},"warnings":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_WarningSchema"}}},"required":["page","perPage","total","data"]}

package/src/kibana/json/security-detections-api.import-rules.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ImportRules","x-api":{"id":"security-detections-api.import-rules","name":"import-rules","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/rules/_import","x-destructive":true,"type":"object","properties":{"overwrite":{"type":"boolean","description":"Determines whether existing rules with the same `rule_id` are overwritten.","x-found-in":"query"},"overwrite_exceptions":{"type":"boolean","description":"Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.","x-found-in":"query"},"overwrite_action_connectors":{"type":"boolean","description":"Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.","x-found-in":"query"},"as_new_list":{"type":"boolean","description":"Generates a new list ID for each imported exception list.","x-found-in":"query"}}}

package/src/kibana/json/security-detections-api.import-rules.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ImportRules","x-api":{"id":"security-detections-api.import-rules","name":"import-rules","namespace":"security-detections-api"},"type":"object","properties":{"action_connectors_errors":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ErrorSchema"}},"action_connectors_success":{"type":"boolean"},"action_connectors_success_count":{"type":"number"},"action_connectors_warnings":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_WarningSchema"}},"errors":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ErrorSchema"}},"exceptions_errors":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ErrorSchema"}},"exceptions_success":{"type":"boolean"},"exceptions_success_count":{"type":"number"},"rules_count":{"type":"number"},"success":{"type":"boolean"},"success_count":{"type":"number"}},"required":["exceptions_success","exceptions_success_count","exceptions_errors","rules_count","success","success_count","errors","action_connectors_errors","action_connectors_warnings","action_connectors_success","action_connectors_success_count"]}

package/src/kibana/json/security-detections-api.patch-rule.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchRule","x-api":{"id":"security-detections-api.patch-rule","name":"patch-rule","namespace":"security-detections-api"},"x-method":"PATCH","x-path":"/api/detection_engine/rules","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RulePatchProps","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.patch-rule.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchRule","x-api":{"id":"security-detections-api.patch-rule","name":"patch-rule","namespace":"security-detections-api"},"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse"}

package/src/kibana/json/security-detections-api.perform-rules-bulk-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformRulesBulkAction","x-api":{"id":"security-detections-api.perform-rules-bulk-action","name":"perform-rules-bulk-action","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/rules/_bulk_action","x-destructive":true,"type":"object","properties":{"dry_run":{"type":"boolean","description":"Enables dry run mode for the request call.\n\nEnable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.\n\nTo enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.\n> info\n> Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.\n","x-found-in":"query"},"action":{"enum":["edit"],"x-found-in":"body"},"gap_auto_fill_scheduler_id":{"type":"string","description":"Gap auto fill scheduler ID used to determine gap fill status for rules","x-found-in":"body"},"gap_fill_statuses":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_GapFillStatus"},"description":"Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).","x-found-in":"body"},"gaps_range_end":{"type":"string","description":"Gaps range end, valid only when query is provided","x-found-in":"body"},"gaps_range_start":{"type":"string","description":"Gaps range start, valid only when query is provided","x-found-in":"body"},"ids":{"type":"array","items":{"type":"string"},"description":"Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n","x-found-in":"body"},"query":{"type":"string","description":"Query to filter rules.","x-found-in":"body"},"duplicate":{"type":"object","properties":{"include_exceptions":{"type":"boolean","description":"Whether to copy exceptions from the original rule"},"include_expired_exceptions":{"type":"boolean","description":"Whether to copy expired exceptions from the original rule"}},"required":["include_exceptions","include_expired_exceptions"],"description":"Duplicate object that describes applying an update action.","x-found-in":"body"},"run":{"type":"object","properties":{"end_date":{"type":"string","description":"End date of the manual rule run"},"start_date":{"type":"string","description":"Start date of the manual rule run"}},"required":["start_date","end_date"],"description":"Object that describes applying a manual rule run action.","x-found-in":"body"},"fill_gaps":{"type":"object","properties":{"end_date":{"type":"string","description":"End date of the manual gap fill"},"start_date":{"type":"string","description":"Start date of the manual gap fill"}},"required":["start_date","end_date"],"description":"Object that describes applying a manual gap fill action for the specified time range.","x-found-in":"body"},"edit":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkActionEditPayload"},"description":"Array of objects containing the edit operations","x-found-in":"body"}},"required":["action"]}

package/src/kibana/json/security-detections-api.perform-rules-bulk-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformRulesBulkAction","x-api":{"id":"security-detections-api.perform-rules-bulk-action","name":"perform-rules-bulk-action","namespace":"security-detections-api"},"oneOf":[{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkEditActionResponse"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkExportActionResponse"}]}

package/src/kibana/json/security-detections-api.read-privileges.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadPrivileges","x-api":{"id":"security-detections-api.read-privileges","name":"read-privileges","namespace":"security-detections-api"},"x-method":"GET","x-path":"/api/detection_engine/privileges","x-destructive":false,"type":"object","properties":{}}

package/src/kibana/json/security-detections-api.read-privileges.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadPrivileges","x-api":{"id":"security-detections-api.read-privileges","name":"read-privileges","namespace":"security-detections-api"},"type":"object","properties":{"has_encryption_key":{"type":"boolean"},"is_authenticated":{"type":"boolean"}},"required":["is_authenticated","has_encryption_key"]}

package/src/kibana/json/security-detections-api.read-rule.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadRule","x-api":{"id":"security-detections-api.read-rule","name":"read-rule","namespace":"security-detections-api"},"x-method":"GET","x-path":"/api/detection_engine/rules","x-destructive":false,"type":"object","properties":{"id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_UUID","description":"The rule's `id` value.","x-found-in":"query"},"rule_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleSignatureId","description":"The rule's `rule_id` value.","x-found-in":"query"}}}

package/src/kibana/json/security-detections-api.read-rule.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadRule","x-api":{"id":"security-detections-api.read-rule","name":"read-rule","namespace":"security-detections-api"},"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse"}

package/src/kibana/json/security-detections-api.read-tags.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadTags","x-api":{"id":"security-detections-api.read-tags","name":"read-tags","namespace":"security-detections-api"},"x-method":"GET","x-path":"/api/detection_engine/tags","x-destructive":false,"type":"object","properties":{}}

package/src/kibana/json/security-detections-api.read-tags.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadTags","x-api":{"id":"security-detections-api.read-tags","name":"read-tags","namespace":"security-detections-api"},"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleTagArray"}

package/src/kibana/json/security-detections-api.rule-preview.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"RulePreview","x-api":{"id":"security-detections-api.rule-preview","name":"rule-preview","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/rules/preview","x-destructive":true,"type":"object","properties":{"enable_logged_requests":{"type":"boolean","description":"Enables logging and returning in response ES queries, performed during rule execution","x-found-in":"query"},"actions":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleAction"},"description":"Array defining the automated actions (notifications) taken when alerts are generated.","x-found-in":"body"},"alias_purpose":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SavedObjectResolveAliasPurpose","x-found-in":"body"},"alias_target_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SavedObjectResolveAliasTargetId","x-found-in":"body"},"author":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleAuthorArray","x-found-in":"body"},"building_block_type":{"$ref":"./_defs.json#/$defs/Security_Detections_API_BuildingBlockType","x-found-in":"body"},"description":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleDescription","x-found-in":"body"},"enabled":{"$ref":"./_defs.json#/$defs/Security_Detections_API_IsRuleEnabled","x-found-in":"body"},"exceptions_list":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleExceptionList"},"x-found-in":"body"},"false_positives":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleFalsePositiveArray","x-found-in":"body"},"from":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleIntervalFrom","x-found-in":"body"},"interval":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleInterval","x-found-in":"body"},"investigation_fields":{"$ref":"./_defs.json#/$defs/Security_Detections_API_InvestigationFields","x-found-in":"body"},"license":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleLicense","x-found-in":"body"},"max_signals":{"$ref":"./_defs.json#/$defs/Security_Detections_API_MaxSignals","x-found-in":"body"},"meta":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleMetadata","x-found-in":"body"},"name":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleName","x-found-in":"body"},"namespace":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AlertsIndexNamespace","x-found-in":"body"},"note":{"$ref":"./_defs.json#/$defs/Security_Detections_API_InvestigationGuide","x-found-in":"body"},"outcome":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SavedObjectResolveOutcome","x-found-in":"body"},"output_index":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AlertsIndex","x-found-in":"body"},"references":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleReferenceArray","x-found-in":"body"},"related_integrations":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RelatedIntegrationArray","x-found-in":"body"},"required_fields":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RequiredFieldInput"},"description":"Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n","x-found-in":"body"},"response_actions":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ResponseAction"},"x-found-in":"body"},"risk_score":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RiskScore","x-found-in":"body"},"risk_score_mapping":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RiskScoreMapping","x-found-in":"body"},"rule_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleSignatureId","x-found-in":"body"},"rule_name_override":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleNameOverride","x-found-in":"body"},"setup":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SetupGuide","x-found-in":"body"},"severity":{"$ref":"./_defs.json#/$defs/Security_Detections_API_Severity","x-found-in":"body"},"severity_mapping":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SeverityMapping","x-found-in":"body"},"tags":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleTagArray","x-found-in":"body"},"threat":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ThreatArray","x-found-in":"body"},"throttle":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleActionThrottle","x-found-in":"body"},"timeline_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_TimelineTemplateId","x-found-in":"body"},"timeline_title":{"$ref":"./_defs.json#/$defs/Security_Detections_API_TimelineTemplateTitle","x-found-in":"body"},"timestamp_override":{"$ref":"./_defs.json#/$defs/Security_Detections_API_TimestampOverride","x-found-in":"body"},"timestamp_override_fallback_disabled":{"$ref":"./_defs.json#/$defs/Security_Detections_API_TimestampOverrideFallbackDisabled","x-found-in":"body"},"to":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleIntervalTo","x-found-in":"body"},"version":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleVersion","x-found-in":"body"},"language":{"$ref":"./_defs.json#/$defs/Security_Detections_API_EsqlQueryLanguage","x-found-in":"body"},"query":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleQuery","x-found-in":"body"},"type":{"enum":["esql"],"description":"Rule type","x-found-in":"body"},"alert_suppression":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AlertSuppression","x-found-in":"body"},"data_view_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_DataViewId","x-found-in":"body"},"event_category_override":{"$ref":"./_defs.json#/$defs/Security_Detections_API_EventCategoryOverride","x-found-in":"body"},"filters":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleFilterArray","x-found-in":"body"},"index":{"$ref":"./_defs.json#/$defs/Security_Detections_API_IndexPatternArray","x-found-in":"body"},"tiebreaker_field":{"$ref":"./_defs.json#/$defs/Security_Detections_API_TiebreakerField","x-found-in":"body"},"timestamp_field":{"$ref":"./_defs.json#/$defs/Security_Detections_API_TimestampField","x-found-in":"body"},"invocationCount":{"type":"number","x-found-in":"body"},"timeframeEnd":{"type":"string","x-found-in":"body"},"saved_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SavedQueryId","x-found-in":"body"},"threshold":{"$ref":"./_defs.json#/$defs/Security_Detections_API_Threshold","x-found-in":"body"},"threat_index":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ThreatIndex","x-found-in":"body"},"threat_mapping":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ThreatMapping","x-found-in":"body"},"threat_query":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ThreatQuery","x-found-in":"body"},"concurrent_searches":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ConcurrentSearches","x-found-in":"body"},"items_per_search":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ItemsPerSearch","x-found-in":"body"},"threat_filters":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ThreatFilters","x-found-in":"body"},"threat_indicator_path":{"$ref":"./_defs.json#/$defs/Security_Detections_API_ThreatIndicatorPath","x-found-in":"body"},"threat_language":{"$ref":"./_defs.json#/$defs/Security_Detections_API_KqlQueryLanguage","x-found-in":"body"},"anomaly_threshold":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AnomalyThreshold","x-found-in":"body"},"machine_learning_job_id":{"$ref":"./_defs.json#/$defs/Security_Detections_API_MachineLearningJobId","x-found-in":"body"},"history_window_start":{"$ref":"./_defs.json#/$defs/Security_Detections_API_HistoryWindowStart","x-found-in":"body"},"new_terms_fields":{"$ref":"./_defs.json#/$defs/Security_Detections_API_NewTermsFields","x-found-in":"body"}},"required":["name","description","risk_score","severity","type","invocationCount","timeframeEnd"]}

package/src/kibana/json/security-detections-api.rule-preview.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"RulePreview","x-api":{"id":"security-detections-api.rule-preview","name":"rule-preview","namespace":"security-detections-api"},"type":"object","properties":{"isAborted":{"type":"boolean"},"logs":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RulePreviewLogs"}},"previewId":{"$ref":"./_defs.json#/$defs/Security_Detections_API_NonEmptyString"}},"required":["logs"]}

package/src/kibana/json/security-detections-api.search-alerts.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SearchAlerts","x-api":{"id":"security-detections-api.search-alerts","name":"search-alerts","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/signals/search","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Detections_API_QueryAlertsBodyParams","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.search-alerts.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SearchAlerts","x-api":{"id":"security-detections-api.search-alerts","name":"search-alerts","namespace":"security-detections-api"},"type":"object","additionalProperties":true}

package/src/kibana/json/security-detections-api.set-alert-assignees.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SetAlertAssignees","x-api":{"id":"security-detections-api.set-alert-assignees","name":"set-alert-assignees","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/signals/assignees","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SetAlertAssigneesBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.set-alert-assignees.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SetAlertAssignees","x-api":{"id":"security-detections-api.set-alert-assignees","name":"set-alert-assignees","namespace":"security-detections-api"},"type":"object","additionalProperties":true}

package/src/kibana/json/security-detections-api.set-alert-tags.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SetAlertTags","x-api":{"id":"security-detections-api.set-alert-tags","name":"set-alert-tags","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/signals/tags","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Detections_API_SetAlertTagsBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.set-alert-tags.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SetAlertTags","x-api":{"id":"security-detections-api.set-alert-tags","name":"set-alert-tags","namespace":"security-detections-api"},"type":"object","additionalProperties":true}

package/src/kibana/json/security-detections-api.set-alerts-status.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SetAlertsStatus","x-api":{"id":"security-detections-api.set-alerts-status","name":"set-alerts-status","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/signals/status","x-destructive":true,"type":"object","properties":{"reason":{"$ref":"./_defs.json#/$defs/Security_Detections_API_Reason","x-found-in":"body"},"signal_ids":{"type":"array","items":{"type":"string"},"description":"List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.","x-found-in":"body"},"status":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AlertStatusExceptClosed","x-found-in":"body"},"conflicts":{"enum":["abort","proceed"],"x-found-in":"body"},"query":{"type":"object","additionalProperties":true,"x-found-in":"body"}},"required":["status"]}

package/src/kibana/json/security-detections-api.set-alerts-status.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"SetAlertsStatus","x-api":{"id":"security-detections-api.set-alerts-status","name":"set-alerts-status","namespace":"security-detections-api"},"type":"object","additionalProperties":true}

package/src/kibana/json/security-detections-api.update-rule.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"UpdateRule","x-api":{"id":"security-detections-api.update-rule","name":"update-rule","namespace":"security-detections-api"},"x-method":"PUT","x-path":"/api/detection_engine/rules","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleUpdateProps","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-detections-api.update-rule.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"UpdateRule","x-api":{"id":"security-detections-api.update-rule","name":"update-rule","namespace":"security-detections-api"},"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse"}

package/src/kibana/json/security-endpoint-exceptions-api.create-endpoint-list-item.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.create-endpoint-list-item","name":"create-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"x-method":"POST","x-path":"/api/endpoint_list/items","x-destructive":false,"type":"object","properties":{"comments":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray","x-found-in":"body"},"description":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemDescription","x-found-in":"body"},"entries":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray","x-found-in":"body"},"item_id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId","x-found-in":"body"},"meta":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemMeta","x-found-in":"body"},"name":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemName","x-found-in":"body"},"os_types":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray","x-found-in":"body"},"tags":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemTags","x-found-in":"body"},"type":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemType","x-found-in":"body"}},"required":["type","name","description","entries"]}

package/src/kibana/json/security-endpoint-exceptions-api.create-endpoint-list-item.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.create-endpoint-list-item","name":"create-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItem"}

package/src/kibana/json/security-endpoint-exceptions-api.create-endpoint-list.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateEndpointList","x-api":{"id":"security-endpoint-exceptions-api.create-endpoint-list","name":"create-endpoint-list","namespace":"security-endpoint-exceptions-api"},"x-method":"POST","x-path":"/api/endpoint_list","x-destructive":false,"type":"object","properties":{}}

package/src/kibana/json/security-endpoint-exceptions-api.create-endpoint-list.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateEndpointList","x-api":{"id":"security-endpoint-exceptions-api.create-endpoint-list","name":"create-endpoint-list","namespace":"security-endpoint-exceptions-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_EndpointList"}

package/src/kibana/json/security-endpoint-exceptions-api.delete-endpoint-list-item.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"DeleteEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.delete-endpoint-list-item","name":"delete-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"x-method":"DELETE","x-path":"/api/endpoint_list/items","x-destructive":true,"type":"object","properties":{"id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemId","description":"Either `id` or `item_id` must be specified","x-found-in":"query"},"item_id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId","description":"Either `id` or `item_id` must be specified","x-found-in":"query"}}}

package/src/kibana/json/security-endpoint-exceptions-api.delete-endpoint-list-item.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"DeleteEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.delete-endpoint-list-item","name":"delete-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItem"}

package/src/kibana/json/security-endpoint-exceptions-api.find-endpoint-list-items.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"FindEndpointListItems","x-api":{"id":"security-endpoint-exceptions-api.find-endpoint-list-items","name":"find-endpoint-list-items","namespace":"security-endpoint-exceptions-api"},"x-method":"GET","x-path":"/api/endpoint_list/items/_find","x-destructive":false,"type":"object","properties":{"filter":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_NonEmptyString","description":"Filters the returned results according to the value of the specified field,\nusing the `<field name>:<field value>` syntax.\n","x-found-in":"query"},"page":{"type":"number","description":"The page number to return","x-found-in":"query"},"per_page":{"type":"number","description":"The number of exception list items to return per page","x-found-in":"query"},"sort_field":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_NonEmptyString","description":"Determines which field is used to sort the results","x-found-in":"query"},"sort_order":{"enum":["desc","asc"],"description":"Determines the sort order, which can be `desc` or `asc`","x-found-in":"query"}}}

package/src/kibana/json/security-endpoint-exceptions-api.find-endpoint-list-items.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"FindEndpointListItems","x-api":{"id":"security-endpoint-exceptions-api.find-endpoint-list-items","name":"find-endpoint-list-items","namespace":"security-endpoint-exceptions-api"},"type":"object","properties":{"data":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItem"},"description":"The list of endpoint exception list items."},"page":{"type":"number","description":"The current page number."},"per_page":{"type":"number","description":"The number of items per page."},"pit":{"type":"string","description":"The point-in-time ID for pagination."},"total":{"type":"number","description":"The total number of endpoint exception list items."}},"required":["data","page","per_page","total"]}

package/src/kibana/json/security-endpoint-exceptions-api.read-endpoint-list-item.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.read-endpoint-list-item","name":"read-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"x-method":"GET","x-path":"/api/endpoint_list/items","x-destructive":false,"type":"object","properties":{"id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemId","description":"Either `id` or `item_id` must be specified","x-found-in":"query"},"item_id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId","description":"Either `id` or `item_id` must be specified","x-found-in":"query"}}}

package/src/kibana/json/security-endpoint-exceptions-api.read-endpoint-list-item.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ReadEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.read-endpoint-list-item","name":"read-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItem"}

package/src/kibana/json/security-endpoint-exceptions-api.update-endpoint-list-item.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"UpdateEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.update-endpoint-list-item","name":"update-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"x-method":"PUT","x-path":"/api/endpoint_list/items","x-destructive":true,"type":"object","properties":{"_version":{"type":"string","description":"The version id, normally returned by the API when the item is retrieved. Use it ensure updates are made against the latest version.","x-found-in":"body"},"comments":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray","x-found-in":"body"},"description":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemDescription","x-found-in":"body"},"entries":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray","x-found-in":"body"},"id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemId","description":"Either `id` or `item_id` must be specified","x-found-in":"body"},"item_id":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId","description":"Either `id` or `item_id` must be specified","x-found-in":"body"},"meta":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemMeta","x-found-in":"body"},"name":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemName","x-found-in":"body"},"os_types":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray","x-found-in":"body"},"tags":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemTags","x-found-in":"body"},"type":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItemType","x-found-in":"body"}},"required":["type","name","description","entries"]}

package/src/kibana/json/security-endpoint-exceptions-api.update-endpoint-list-item.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"UpdateEndpointListItem","x-api":{"id":"security-endpoint-exceptions-api.update-endpoint-list-item","name":"update-endpoint-list-item","namespace":"security-endpoint-exceptions-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Exceptions_API_ExceptionListItem"}

package/src/kibana/json/security-endpoint-management-api.cancel-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CancelAction","x-api":{"id":"security-endpoint-management-api.cancel-action","name":"cancel-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/cancel","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_CancelRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.cancel-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CancelAction","x-api":{"id":"security-endpoint-management-api.cancel-action","name":"cancel-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.create-update-protection-updates-note.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateUpdateProtectionUpdatesNote","x-api":{"id":"security-endpoint-management-api.create-update-protection-updates-note","name":"create-update-protection-updates-note","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/protection_updates_note/{package_policy_id}","x-destructive":true,"type":"object","properties":{"package_policy_id":{"type":"string","description":"The package policy ID to create or update the protection updates note for.","x-found-in":"path"},"note":{"type":"string","description":"The note content.","x-found-in":"body"}},"required":["package_policy_id"]}

package/src/kibana/json/security-endpoint-management-api.create-update-protection-updates-note.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"CreateUpdateProtectionUpdatesNote","x-api":{"id":"security-endpoint-management-api.create-update-protection-updates-note","name":"create-update-protection-updates-note","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-execute-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointExecuteAction","x-api":{"id":"security-endpoint-management-api.endpoint-execute-action","name":"endpoint-execute-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/execute","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ExecuteRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-execute-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointExecuteAction","x-api":{"id":"security-endpoint-management-api.endpoint-execute-action","name":"endpoint-execute-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-file-download.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointFileDownload","x-api":{"id":"security-endpoint-management-api.endpoint-file-download","name":"endpoint-file-download","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/action/{action_id}/file/{file_id}/download","x-destructive":false,"type":"object","properties":{"action_id":{"type":"string","description":"The ID of the response action that generated the file.","x-found-in":"path"},"file_id":{"type":"string","description":"The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n","x-found-in":"path"}},"required":["action_id","file_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-file-download.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointFileDownload","x-api":{"id":"security-endpoint-management-api.endpoint-file-download","name":"endpoint-file-download","namespace":"security-endpoint-management-api"},"type":"object","properties":{}}

package/src/kibana/json/security-endpoint-management-api.endpoint-file-info.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointFileInfo","x-api":{"id":"security-endpoint-management-api.endpoint-file-info","name":"endpoint-file-info","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/action/{action_id}/file/{file_id}","x-destructive":false,"type":"object","properties":{"action_id":{"type":"string","description":"The ID of the response action that generated the file.","x-found-in":"path"},"file_id":{"type":"string","description":"The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n","x-found-in":"path"}},"required":["action_id","file_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-file-info.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointFileInfo","x-api":{"id":"security-endpoint-management-api.endpoint-file-info","name":"endpoint-file-info","namespace":"security-endpoint-management-api"},"type":"object","properties":{"data":{"type":"object","properties":{"actionId":{"type":"string","description":"The response action ID."},"agentId":{"type":"string","description":"The agent ID that generated the file."},"agentType":{"type":"string","description":"The type of agent that generated the file."},"created":{"type":"string","description":"The date and time the file was created."},"id":{"type":"string","description":"The unique file identifier."},"mimeType":{"type":"string","description":"The MIME type of the file."},"name":{"type":"string","description":"The file name."},"size":{"type":"number","description":"The file size in bytes."},"status":{"enum":["AWAITING_UPLOAD","UPLOADING","READY","UPLOAD_ERROR","DELETED"],"description":"The file upload status."}}}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-generate-memory-dump.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGenerateMemoryDump","x-api":{"id":"security-endpoint-management-api.endpoint-generate-memory-dump","name":"endpoint-generate-memory-dump","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/memory_dump","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_MemoryDumpRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-generate-memory-dump.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGenerateMemoryDump","x-api":{"id":"security-endpoint-management-api.endpoint-generate-memory-dump","name":"endpoint-generate-memory-dump","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-details.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsDetails","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-details","name":"endpoint-get-actions-details","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/action/{action_id}","x-destructive":false,"type":"object","properties":{"action_id":{"type":"string","description":"The ID of the response action to retrieve.","x-found-in":"path"}},"required":["action_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-details.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsDetails","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-details","name":"endpoint-get-actions-details","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ActionDetailsResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-list.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsList","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-list","name":"endpoint-get-actions-list","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/action","x-destructive":false,"type":"object","properties":{"page":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Page","description":"The page number to return.","x-found-in":"query"},"pageSize":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_PageSize","description":"The number of response actions to return per page.","x-found-in":"query"},"commands":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Commands","description":"A list of response action command names to filter by.","x-found-in":"query"},"agentIds":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_AgentIds","description":"A list of Elastic Agent IDs to filter the response actions by.","x-found-in":"query"},"userIds":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_UserIds","description":"A list of user IDs that submitted the response actions.","x-found-in":"query"},"startDate":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_StartDate","description":"A start date in ISO 8601 format or Date Math format (for example, `now-24h`).","x-found-in":"query"},"endDate":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_EndDate","description":"An end date in ISO 8601 format or Date Math format (for example, `now`).","x-found-in":"query"},"agentTypes":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_AgentTypes","description":"The agent type to filter response actions by. Defaults to `endpoint`.","x-found-in":"query"},"withOutputs":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_WithOutputs","description":"A list of response action IDs whose outputs should be included in the response.","x-found-in":"query"},"types":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Types","description":"A list of response action types to filter by (`automated`, `manual`).","x-found-in":"query"}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-list.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsList","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-list","name":"endpoint-get-actions-list","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_GetEndpointActionListResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-state.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsState","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-state","name":"endpoint-get-actions-state","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/action/state","x-destructive":false,"type":"object","properties":{}}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-state.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsState","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-state","name":"endpoint-get-actions-state","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ActionStateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-status.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsStatus","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-status","name":"endpoint-get-actions-status","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/action_status","x-destructive":false,"type":"object","properties":{"agent_ids":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_AgentIds","description":"A list of agent IDs to get the action status for.","x-found-in":"query"}},"required":["agent_ids"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-actions-status.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetActionsStatus","x-api":{"id":"security-endpoint-management-api.endpoint-get-actions-status","name":"endpoint-get-actions-status","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ActionStatusSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-file-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetFileAction","x-api":{"id":"security-endpoint-management-api.endpoint-get-file-action","name":"endpoint-get-file-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/get_file","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_GetFileRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-file-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetFileAction","x-api":{"id":"security-endpoint-management-api.endpoint-get-file-action","name":"endpoint-get-file-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-processes-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetProcessesAction","x-api":{"id":"security-endpoint-management-api.endpoint-get-processes-action","name":"endpoint-get-processes-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/running_procs","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_GetProcessesRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-get-processes-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointGetProcessesAction","x-api":{"id":"security-endpoint-management-api.endpoint-get-processes-action","name":"endpoint-get-processes-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-isolate-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointIsolateAction","x-api":{"id":"security-endpoint-management-api.endpoint-isolate-action","name":"endpoint-isolate-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/isolate","x-destructive":true,"type":"object","properties":{"agent_type":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_AgentTypes","x-found-in":"body"},"alert_ids":{"type":"array","items":{"type":"string"},"description":"If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.","x-found-in":"body"},"case_ids":{"type":"array","items":{"type":"string"},"description":"The IDs of cases where the action taken will be logged. Max of 50.","x-found-in":"body"},"comment":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Comment","x-found-in":"body"},"endpoint_ids":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_EndpointIds","x-found-in":"body"},"parameters":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Parameters","x-found-in":"body"}},"required":["endpoint_ids"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-isolate-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointIsolateAction","x-api":{"id":"security-endpoint-management-api.endpoint-isolate-action","name":"endpoint-isolate-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_IsolateRouteResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-kill-process-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointKillProcessAction","x-api":{"id":"security-endpoint-management-api.endpoint-kill-process-action","name":"endpoint-kill-process-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/kill_process","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_KillProcessRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-kill-process-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointKillProcessAction","x-api":{"id":"security-endpoint-management-api.endpoint-kill-process-action","name":"endpoint-kill-process-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-scan-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScanAction","x-api":{"id":"security-endpoint-management-api.endpoint-scan-action","name":"endpoint-scan-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/scan","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ScanRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-scan-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScanAction","x-api":{"id":"security-endpoint-management-api.endpoint-scan-action","name":"endpoint-scan-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-create-script.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryCreateScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-create-script","name":"endpoint-script-library-create-script","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/scripts_library","x-destructive":false,"type":"object","properties":{}}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-create-script.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryCreateScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-create-script","name":"endpoint-script-library-create-script","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ScriptsApiResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-delete-script.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryDeleteScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-delete-script","name":"endpoint-script-library-delete-script","namespace":"security-endpoint-management-api"},"x-method":"DELETE","x-path":"/api/endpoint/scripts_library/{script_id}","x-destructive":true,"type":"object","properties":{"script_id":{"type":"string","description":"The ID of the script entry to be deleted.","x-found-in":"path"}},"required":["script_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-delete-script.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryDeleteScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-delete-script","name":"endpoint-script-library-delete-script","namespace":"security-endpoint-management-api"},"type":"object"}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-download-script.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryDownloadScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-download-script","name":"endpoint-script-library-download-script","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/scripts_library/{script_id}/download","x-destructive":false,"type":"object","properties":{"script_id":{"type":"string","description":"The ID of the script entry.","x-found-in":"path"}},"required":["script_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-download-script.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryDownloadScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-download-script","name":"endpoint-script-library-download-script","namespace":"security-endpoint-management-api"},"type":"object","properties":{}}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-get-one-script.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryGetOneScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-get-one-script","name":"endpoint-script-library-get-one-script","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/scripts_library/{script_id}","x-destructive":false,"type":"object","properties":{"script_id":{"type":"string","description":"The ID of the script entry.","x-found-in":"path"}},"required":["script_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-get-one-script.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryGetOneScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-get-one-script","name":"endpoint-script-library-get-one-script","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ScriptsApiResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-list-scripts.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryListScripts","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-list-scripts","name":"endpoint-script-library-list-scripts","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/scripts_library","x-destructive":false,"type":"object","properties":{"page":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Page","description":"Page number of the results to return. Defaults to 1.","x-found-in":"query"},"pageSize":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ApiPageSize","description":"Number of results to return per page. Defaults to 10. Max value is 1000.","x-found-in":"query"},"sortField":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ApiSortField","description":"The field to sort the results by. Defaults to name.","x-found-in":"query"},"sortDirection":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_SortDirection","description":"The direction to sort the results by. Defaults to asc (ascending).","x-found-in":"query"},"kuery":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Kuery","description":"A KQL query string to filter the list of scripts. Nearly all fields in the script object are searchable.\n","x-found-in":"query"}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-list-scripts.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryListScripts","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-list-scripts","name":"endpoint-script-library-list-scripts","namespace":"security-endpoint-management-api"},"type":"object","properties":{"data":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_EndpointScript"}},"page":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Page"},"pageSize":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ApiPageSize"},"sortDirection":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_SortDirection"},"sortField":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ApiSortField"},"total":{"type":"number","description":"The total number of scripts matching the query"}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-patch-update-script.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryPatchUpdateScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-patch-update-script","name":"endpoint-script-library-patch-update-script","namespace":"security-endpoint-management-api"},"x-method":"PATCH","x-path":"/api/endpoint/scripts_library/{script_id}","x-destructive":true,"type":"object","properties":{"script_id":{"type":"string","description":"The ID of the script entry to be updated.","x-found-in":"path"}},"required":["script_id"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-script-library-patch-update-script.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointScriptLibraryPatchUpdateScript","x-api":{"id":"security-endpoint-management-api.endpoint-script-library-patch-update-script","name":"endpoint-script-library-patch-update-script","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ScriptsApiResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-suspend-process-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointSuspendProcessAction","x-api":{"id":"security-endpoint-management-api.endpoint-suspend-process-action","name":"endpoint-suspend-process-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/suspend_process","x-destructive":true,"type":"object","properties":{"body":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_SuspendProcessRouteRequestBody","x-found-in":"body","x-body-root":true}}}

package/src/kibana/json/security-endpoint-management-api.endpoint-suspend-process-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointSuspendProcessAction","x-api":{"id":"security-endpoint-management-api.endpoint-suspend-process-action","name":"endpoint-suspend-process-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-unisolate-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointUnisolateAction","x-api":{"id":"security-endpoint-management-api.endpoint-unisolate-action","name":"endpoint-unisolate-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/unisolate","x-destructive":true,"type":"object","properties":{"agent_type":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_AgentTypes","x-found-in":"body"},"alert_ids":{"type":"array","items":{"type":"string"},"description":"If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.","x-found-in":"body"},"case_ids":{"type":"array","items":{"type":"string"},"description":"The IDs of cases where the action taken will be logged. Max of 50.","x-found-in":"body"},"comment":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Comment","x-found-in":"body"},"endpoint_ids":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_EndpointIds","x-found-in":"body"},"parameters":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Parameters","x-found-in":"body"}},"required":["endpoint_ids"]}

package/src/kibana/json/security-endpoint-management-api.endpoint-unisolate-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointUnisolateAction","x-api":{"id":"security-endpoint-management-api.endpoint-unisolate-action","name":"endpoint-unisolate-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_UnisolateRouteResponse"}

package/src/kibana/json/security-endpoint-management-api.endpoint-upload-action.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointUploadAction","x-api":{"id":"security-endpoint-management-api.endpoint-upload-action","name":"endpoint-upload-action","namespace":"security-endpoint-management-api"},"x-method":"POST","x-path":"/api/endpoint/action/upload","x-destructive":true,"type":"object","properties":{}}

package/src/kibana/json/security-endpoint-management-api.endpoint-upload-action.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"EndpointUploadAction","x-api":{"id":"security-endpoint-management-api.endpoint-upload-action","name":"endpoint-upload-action","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"}

package/src/kibana/json/security-endpoint-management-api.get-endpoint-metadata-list.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetEndpointMetadataList","x-api":{"id":"security-endpoint-management-api.get-endpoint-metadata-list","name":"get-endpoint-metadata-list","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/metadata","x-destructive":false,"type":"object","properties":{"page":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Page","description":"The page number to return.","x-found-in":"query"},"pageSize":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_PageSize","description":"The number of endpoints to return per page.","x-found-in":"query"},"kuery":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_Kuery","description":"A KQL string to filter the endpoint metadata results.","x-found-in":"query"},"hostStatuses":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_HostStatuses","description":"A set of host statuses to filter the results by (for example, `healthy`, `updating`).","x-found-in":"query"},"sortField":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_SortField","description":"The field used to sort the results.","x-found-in":"query"},"sortDirection":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_SortDirection","description":"The sort order, either `asc` or `desc`.","x-found-in":"query"}},"required":["hostStatuses"]}

package/src/kibana/json/security-endpoint-management-api.get-endpoint-metadata-list.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetEndpointMetadataList","x-api":{"id":"security-endpoint-management-api.get-endpoint-metadata-list","name":"get-endpoint-metadata-list","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_MetadataListResponse"}

package/src/kibana/json/security-endpoint-management-api.get-endpoint-metadata.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetEndpointMetadata","x-api":{"id":"security-endpoint-management-api.get-endpoint-metadata","name":"get-endpoint-metadata","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/metadata/{id}","x-destructive":false,"type":"object","properties":{"id":{"type":"string","description":"The agent ID of the endpoint.","x-found-in":"path"}},"required":["id"]}

package/src/kibana/json/security-endpoint-management-api.get-endpoint-metadata.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetEndpointMetadata","x-api":{"id":"security-endpoint-management-api.get-endpoint-metadata","name":"get-endpoint-metadata","namespace":"security-endpoint-management-api"},"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_EndpointMetadataResponse"}

package/src/kibana/json/security-endpoint-management-api.get-policy-response.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetPolicyResponse","x-api":{"id":"security-endpoint-management-api.get-policy-response","name":"get-policy-response","namespace":"security-endpoint-management-api"},"x-method":"GET","x-path":"/api/endpoint/policy_response","x-destructive":false,"type":"object","properties":{"agentId":{"$ref":"./_defs.json#/$defs/Security_Endpoint_Management_API_AgentId","description":"The agent ID to retrieve the policy response for.","x-found-in":"query"}},"required":["agentId"]}