@elastic/schemas 0.6.0 → 0.6.1

package/src/kibana/json/list_watchlists.response.json

@@ -1 +0,0 @@
-{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Entity_Analytics_API_WatchlistObject"},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ListWatchlists"}

package/src/kibana/json/ml_sync.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Machine_learning_APIs_mlSync200Response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"mlSync"}

package/src/kibana/json/observability_ai_assistant_chat_complete.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"actions":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Observability_AI_Assistant_API_Function"}},"connectorId":{"type":"string","description":"A unique identifier for the connector."},"conversationId":{"type":"string","description":"A unique identifier for the conversation if you are continuing an existing conversation."},"disableFunctions":{"type":"boolean","description":"Flag indicating whether all function calls should be disabled for the conversation. If true, no calls to functions will be made."},"instructions":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Observability_AI_Assistant_API_Instruction"},"description":"An array of instruction objects, which can be either simple strings or detailed objects."},"messages":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Observability_AI_Assistant_API_Message"},"description":"An array of message objects containing the conversation history."},"persist":{"type":"boolean","description":"Indicates whether the conversation should be saved to storage. If true, the conversation will be saved and will be available in Kibana."},"title":{"type":"string","description":"A title for the conversation."}},"required":["messages","connectorId","persist"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"observability-ai-assistant-chat-complete"}

package/src/kibana/json/observability_ai_assistant_chat_complete.response.json

@@ -1 +0,0 @@
-{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","title":"observability-ai-assistant-chat-complete"}

package/src/kibana/json/osquery_copy_packs.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The ID of the pack to copy.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCopyPacks"}

package/src/kibana/json/osquery_copy_packs.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CopyPacksResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCopyPacks"}

package/src/kibana/json/osquery_copy_saved_query.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The ID of the saved query to copy.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCopySavedQuery"}

package/src/kibana/json/osquery_copy_saved_query.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CopySavedQueryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCopySavedQuery"}

package/src/kibana/json/osquery_create_live_query.request.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CreateLiveQueryRequestBody","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCreateLiveQuery"}

package/src/kibana/json/osquery_create_live_query.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CreateLiveQueryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCreateLiveQuery"}

package/src/kibana/json/osquery_create_packs.request.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CreatePacksRequestBody","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCreatePacks"}

package/src/kibana/json/osquery_create_packs.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CreatePacksResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCreatePacks"}

package/src/kibana/json/osquery_create_saved_query.request.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CreateSavedQueryRequestBody","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCreateSavedQuery"}

package/src/kibana/json/osquery_create_saved_query.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_CreateSavedQueryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCreateSavedQuery"}

package/src/kibana/json/osquery_delete_packs.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The pack ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryDeletePacks"}

package/src/kibana/json/osquery_delete_packs.response.json

@@ -1 +0,0 @@
-{"type":"object","properties":{},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryDeletePacks"}

package/src/kibana/json/osquery_delete_saved_query.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The saved query ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryDeleteSavedQuery"}

package/src/kibana/json/osquery_delete_saved_query.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_DefaultSuccessResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryDeleteSavedQuery"}

package/src/kibana/json/osquery_find_live_queries.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"kuery":{"type":"string","description":"A KQL search string to filter live queries.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindLiveQueries"}

package/src/kibana/json/osquery_find_live_queries.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_FindLiveQueryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindLiveQueries"}

package/src/kibana/json/osquery_find_packs.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindPacks"}

package/src/kibana/json/osquery_find_packs.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_FindPacksResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindPacks"}

package/src/kibana/json/osquery_find_saved_queries.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindSavedQueries"}

package/src/kibana/json/osquery_find_saved_queries.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_FindSavedQueryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindSavedQueries"}

package/src/kibana/json/osquery_get_live_query_details.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The ID of the live query.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetLiveQueryDetails"}

package/src/kibana/json/osquery_get_live_query_details.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_FindLiveQueryDetailsResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetLiveQueryDetails"}

package/src/kibana/json/osquery_get_live_query_results.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The ID of the live query.","x-found-in":"path"},"actionId":{"type":"string","description":"The ID of the query action.","x-found-in":"path"},"kuery":{"type":"string","description":"A KQL search string to filter results.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"required":["id","actionId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetLiveQueryResults"}

package/src/kibana/json/osquery_get_live_query_results.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_GetLiveQueryResultsResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetLiveQueryResults"}

package/src/kibana/json/osquery_get_packs_details.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The pack ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetPacksDetails"}

package/src/kibana/json/osquery_get_packs_details.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_FindPackResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetPacksDetails"}

package/src/kibana/json/osquery_get_saved_query_details.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The saved query ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetSavedQueryDetails"}

package/src/kibana/json/osquery_get_saved_query_details.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_FindSavedQueryDetailResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetSavedQueryDetails"}

package/src/kibana/json/osquery_get_scheduled_action_results.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"scheduleId":{"type":"string","description":"The schedule ID of the scheduled query.","x-found-in":"path"},"executionCount":{"type":"number","description":"The execution count for this scheduled query run.","x-found-in":"path"},"kuery":{"type":"string","description":"The kuery to filter the results by.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return. The default is 1.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page. The default is 20.","x-found-in":"query"},"sort":{"type":"string","description":"The field that is used to sort the results.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Specifies the sort order.","x-found-in":"query"}},"required":["scheduleId","executionCount"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetScheduledActionResults"}

package/src/kibana/json/osquery_get_scheduled_action_results.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_GetScheduledActionResultsResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetScheduledActionResults"}

package/src/kibana/json/osquery_get_scheduled_query_results.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"scheduleId":{"type":"string","description":"The schedule ID of the scheduled query.","x-found-in":"path"},"executionCount":{"type":"number","description":"The execution count for this scheduled query run.","x-found-in":"path"},"kuery":{"type":"string","description":"The kuery to filter the results by.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return. The default is 1.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page. The default is 20.","x-found-in":"query"},"sort":{"type":"string","description":"The field that is used to sort the results.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Specifies the sort order.","x-found-in":"query"},"startDate":{"type":"string","description":"The start date filter (ISO 8601) to narrow down results.","x-found-in":"query"}},"required":["scheduleId","executionCount"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetScheduledQueryResults"}

package/src/kibana/json/osquery_get_scheduled_query_results.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_GetScheduledQueryResultsResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetScheduledQueryResults"}

package/src/kibana/json/osquery_get_unified_history.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"nextPage":{"type":"string","description":"A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.","x-found-in":"query"},"kuery":{"type":"string","description":"A search string to filter history entries by pack name, query text, or query ID.","x-found-in":"query"},"userIds":{"type":"string","description":"Comma-separated list of user IDs to filter live query history.","x-found-in":"query"},"sourceFilters":{"type":"string","description":"Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.","x-found-in":"query"},"startDate":{"type":"string","description":"The start of the time range filter (ISO 8601).","x-found-in":"query"},"endDate":{"type":"string","description":"The end of the time range filter (ISO 8601).","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetUnifiedHistory"}

package/src/kibana/json/osquery_get_unified_history.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_GetUnifiedHistoryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetUnifiedHistory"}

package/src/kibana/json/osquery_update_packs.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The pack ID.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdatePacksRequestBody"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdatePacks"}

package/src/kibana/json/osquery_update_packs.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdatePacksResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdatePacks"}

package/src/kibana/json/osquery_update_saved_query.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The saved query ID.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdateSavedQueryRequestBody"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdateSavedQuery"}

package/src/kibana/json/osquery_update_saved_query.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdateSavedQueryResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdateSavedQuery"}

package/src/kibana/json/patch_agent_builder_conversations_conversation_id_attachments_attachment_id.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"conversation_id":{"type":"string","description":"The unique identifier of the conversation.","x-found-in":"path"},"attachment_id":{"type":"string","description":"The unique identifier of the attachment to rename.","x-found-in":"path"}},"required":["conversation_id","attachment_id"],"allOf":[{"type":"object","properties":{"description":{"type":"string","description":"The new description/name for the attachment."}},"required":["description"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-agent-builder-conversations-conversation-id-attachments-attachment-id"}

package/src/kibana/json/patch_list.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"_version":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListVersionId"},"description":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListDescription"},"id":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListId"},"meta":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListMetadata"},"name":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListName"},"version":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListVersion"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchList"}

package/src/kibana/json/patch_list.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Lists_API_List","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchList"}

package/src/kibana/json/patch_list_item.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"_version":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListVersionId"},"id":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListItemId"},"meta":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListItemMetadata"},"refresh":{"enum":["true","false","wait_for"],"description":"Determines when changes made by the request are made visible to search."},"value":{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListItemValue"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchListItem"}

package/src/kibana/json/patch_list_item.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Lists_API_ListItem","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchListItem"}

package/src/kibana/json/patch_maintenance_window_id.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the maintenance window.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_update_maintenance_window"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-maintenance-window-id"}

package/src/kibana/json/patch_maintenance_window_id.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_maintenance_window_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-maintenance-window-id"}

package/src/kibana/json/patch_rule.request.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Detections_API_RulePatchProps","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchRule"}

package/src/kibana/json/patch_rule.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuleResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchRule"}

package/src/kibana/json/patch_timeline.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"timeline":{"$ref":"./_defs.json#/$defs/Security_Timeline_API_SavedTimeline","description":"The timeline object of the Timeline or Timeline template that you’re updating."},"timelineId":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"The `savedObjectId` of the Timeline or Timeline template that you’re updating."},"version":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"The version of the Timeline or Timeline template that you’re updating."}},"required":["timelineId","version","timeline"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchTimeline"}

package/src/kibana/json/patch_timeline.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Timeline_API_TimelineResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PatchTimeline"}

package/src/kibana/json/perform_anonymization_fields_bulk_action.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"create":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_AnonymizationFieldCreateProps"},"description":"Array of anonymization fields to create."},"delete":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Array of IDs to apply the action to."},"query":{"type":"string","description":"Query to filter the bulk action."}},"description":"Object containing the query to filter anonymization fields and/or an array of anonymization field IDs to delete."},"update":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_AnonymizationFieldUpdateProps"},"description":"Array of anonymization fields to update."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformAnonymizationFieldsBulkAction"}

package/src/kibana/json/perform_anonymization_fields_bulk_action.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformAnonymizationFieldsBulkAction"}

package/src/kibana/json/perform_knowledge_base_entry_bulk_action.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"create":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps"},"description":"List of Knowledge Base Entries to create."},"delete":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Array of Knowledge Base Entry IDs."},"query":{"type":"string","description":"Query to filter Knowledge Base Entries."}}},"update":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps"},"description":"List of Knowledge Base Entries to update."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformKnowledgeBaseEntryBulkAction"}

package/src/kibana/json/perform_knowledge_base_entry_bulk_action.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformKnowledgeBaseEntryBulkAction"}

package/src/kibana/json/perform_prompts_bulk_action.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"create":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_PromptCreateProps"},"description":"List of prompts to be created."},"delete":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Array of IDs to apply the action to."},"query":{"type":"string","description":"Query to filter the bulk action."}},"description":"Criteria for deleting prompts in bulk."},"update":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_PromptUpdateProps"},"description":"List of prompts to be updated."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformPromptsBulkAction"}

package/src/kibana/json/perform_prompts_bulk_action.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_AI_Assistant_API_PromptsBulkCrudActionResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformPromptsBulkAction"}

package/src/kibana/json/perform_rules_bulk_action.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"dry_run":{"type":"boolean","description":"Enables dry run mode for the request call.","x-found-in":"query"}},"allOf":[{"type":"object","properties":{"action":{"enum":["edit"]},"gap_auto_fill_scheduler_id":{"type":"string","description":"Gap auto fill scheduler ID used to determine gap fill status for rules"},"gap_fill_statuses":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_GapFillStatus"},"description":"Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."},"gaps_range_end":{"type":"string","description":"Gaps range end, valid only when query is provided"},"gaps_range_start":{"type":"string","description":"Gaps range start, valid only when query is provided"},"ids":{"type":"array","items":{"type":"string"},"description":"Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"},"query":{"type":"string","description":"Query to filter rules."},"duplicate":{"type":"object","properties":{"include_exceptions":{"type":"boolean","description":"Whether to copy exceptions from the original rule"},"include_expired_exceptions":{"type":"boolean","description":"Whether to copy expired exceptions from the original rule"}},"required":["include_exceptions","include_expired_exceptions"],"description":"Duplicate object that describes applying an update action."},"run":{"type":"object","properties":{"end_date":{"type":"string","description":"End date of the manual rule run"},"start_date":{"type":"string","description":"Start date of the manual rule run"}},"required":["start_date","end_date"],"description":"Object that describes applying a manual rule run action."},"fill_gaps":{"type":"object","properties":{"end_date":{"type":"string","description":"End date of the manual gap fill"},"start_date":{"type":"string","description":"Start date of the manual gap fill"}},"required":["start_date","end_date"],"description":"Object that describes applying a manual gap fill action for the specified time range."},"edit":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkActionEditPayload"},"description":"Array of objects containing the edit operations"}},"required":["action"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformRulesBulkAction"}

package/src/kibana/json/perform_rules_bulk_action.response.json

@@ -1 +0,0 @@
-{"oneOf":[{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkEditActionResponse"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkExportActionResponse"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformRulesBulkAction"}

package/src/kibana/json/persist_favorite_route.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"templateTimelineId":{"oneOf":[{"type":"string"},{"type":"null"}]},"templateTimelineVersion":{"oneOf":[{"type":"number"},{"type":"null"}]},"timelineId":{"oneOf":[{"type":"string"},{"type":"null"}]},"timelineType":{"$ref":"./_defs.json#/$defs/Security_Timeline_API_TimelineType"}},"required":["timelineId","templateTimelineId","templateTimelineVersion","timelineType"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PersistFavoriteRoute"}

package/src/kibana/json/persist_favorite_route.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Timeline_API_FavoriteTimelineResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PersistFavoriteRoute"}

package/src/kibana/json/persist_note_route.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"note":{"$ref":"./_defs.json#/$defs/Security_Timeline_API_BareNote","description":"Note payload (timeline, text, optional event linkage, metadata)."},"noteId":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"The `savedObjectId` of the note to update. Omit when creating a new note."},"version":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Saved object version string from a previous read; optional on update."}},"required":["note"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PersistNoteRoute"}

package/src/kibana/json/persist_note_route.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Timeline_API_ResponseNote","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PersistNoteRoute"}

package/src/kibana/json/persist_pinned_event_route.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"eventId":{"type":"string","description":"The `_id` of the associated event for this pinned event."},"pinnedEventId":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"The `savedObjectId` of the pinned event you want to unpin."},"timelineId":{"type":"string","description":"The `savedObjectId` of the timeline that you want this pinned event unpinned from."}},"required":["eventId","timelineId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PersistPinnedEventRoute"}

package/src/kibana/json/persist_pinned_event_route.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Timeline_API_PersistPinnedEventResponse","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PersistPinnedEventRoute"}

package/src/kibana/json/post_actions_connector_id.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"An identifier for the connector.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_connector"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id"}

package/src/kibana/json/post_actions_connector_id.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_connector_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id"}

package/src/kibana/json/post_actions_connector_id_execute.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"An identifier for the connector.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_connector_execute_request"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id-execute"}

package/src/kibana/json/post_actions_connector_id_execute.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_connector_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id-execute"}

package/src/kibana/json/post_agent_builder_a2a_agentid.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"agentId":{"type":"string","description":"The unique identifier of the agent to send the A2A task to.","x-found-in":"path"}},"required":["agentId"],"allOf":[{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-a2a-agentid"}

package/src/kibana/json/post_agent_builder_agents.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"avatar_color":{"type":"string","description":"Optional hex color code for the agent avatar."},"avatar_symbol":{"type":"string","description":"Optional symbol/initials for the agent avatar."},"configuration":{"type":"object","properties":{"connector_ids":{"type":"array","items":{"type":"string"},"description":"Array of connector IDs to associate with the agent."},"enable_elastic_capabilities":{"type":"boolean","description":"When true, enables built-in Elastic capabilities for the agent."},"instructions":{"type":"string","description":"Optional system instructions that define the agent behavior."},"plugin_ids":{"type":"array","items":{"type":"string"},"description":"Array of plugin IDs to assign to the agent."},"skill_ids":{"type":"array","items":{"type":"string"},"description":"Array of skill IDs to be available to the agent."},"tools":{"type":"array","items":{"type":"object","properties":{"tool_ids":{"type":"array","items":{"type":"string"},"description":"Array of tool IDs that the agent can use."}},"required":["tool_ids"]}},"workflow_ids":{"type":"array","items":{"type":"string"}}},"required":["tools"],"description":"Configuration settings for the agent."},"description":{"type":"string","description":"Description of what the agent does."},"id":{"type":"string","description":"Unique identifier for the agent."},"labels":{"type":"array","items":{"type":"string"},"description":"Optional labels for categorizing and organizing agents."},"name":{"type":"string","description":"Display name for the agent."},"visibility":{"enum":["public","shared","private"],"description":"**Technical Preview; added in 9.4.0.** Optional visibility setting: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write)."}},"required":["id","name","description","configuration"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-agents"}

package/src/kibana/json/post_agent_builder_agents_agent_id_consumption.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"agent_id":{"type":"string","description":"The unique identifier of the agent.","x-found-in":"path"}},"required":["agent_id"],"allOf":[{"type":"object","properties":{"has_warnings":{"type":"boolean","description":"Filter to conversations with or without high-token warnings."},"search":{"type":"string","description":"Free-text search filter on conversation title."},"search_after":{"type":"array","items":{},"description":"Cursor for pagination. Pass the search_after value from the previous response."},"size":{"type":"number","description":"Number of results per page."},"sort_field":{"enum":["updated_at","total_tokens","round_count"],"description":"Field to sort results by."},"sort_order":{"enum":["asc","desc"],"description":"Sort direction."},"usernames":{"type":"array","items":{"type":"string"},"description":"Filter results to conversations by these usernames."}}}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-agents-agent-id-consumption"}

package/src/kibana/json/post_agent_builder_conversations_conversation_id_attachments.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"conversation_id":{"type":"string","description":"The unique identifier of the conversation.","x-found-in":"path"}},"required":["conversation_id"],"allOf":[{"type":"object","properties":{"data":{"description":"The attachment data/content. Required unless origin is provided."},"description":{"type":"string","description":"Human-readable description of the attachment."},"hidden":{"type":"boolean","description":"Whether the attachment should be hidden from the user."},"id":{"type":"string","description":"Optional custom ID for the attachment."},"origin":{"type":"string","description":"Origin string (for example, saved object ID) for by-reference attachments. When provided without data, the content is resolved once at creation time."},"type":{"type":"string","description":"The type of the attachment (e.g., text, esql, visualization)."}},"required":["type","data"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-conversations-conversation-id-attachments"}

package/src/kibana/json/post_agent_builder_conversations_conversation_id_attachments_attachment_id_restore.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"conversation_id":{"type":"string","description":"The unique identifier of the conversation.","x-found-in":"path"},"attachment_id":{"type":"string","description":"The unique identifier of the attachment to restore.","x-found-in":"path"}},"required":["conversation_id","attachment_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-conversations-conversation-id-attachments-attachment-id-restore"}

package/src/kibana/json/post_agent_builder_converse.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"_execution_mode":{"enum":["local","task_manager"],"description":"**Experimental; added in 9.4.0.** define how to execute the agent (local execution or via task_manager)"},"action":{"enum":["regenerate"],"description":"The action to perform. \"regenerate\" re-executes the last round with the original input. Requires conversation_id."},"agent_id":{"type":"string","description":"The ID of the agent to chat with. Defaults to the default Elastic AI agent."},"attachments":{"type":"array","items":{"type":"object","properties":{"data":{"type":"object","additionalProperties":{},"description":"Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time)."},"description":{"type":"string","description":"Human-readable label for the attachment."},"group_id":{"type":"string","description":"Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity."},"hidden":{"type":"boolean","description":"When true, the attachment will not be displayed in the UI."},"id":{"type":"string","description":"Optional id for the attachment."},"origin":{"type":"string","description":"Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook."},"type":{"type":"string","description":"Type of the attachment."}},"required":["type"]},"description":"**Technical Preview; added in 9.3.0.** Optional attachments to send with the message."},"browser_api_tools":{"type":"array","items":{"type":"object","properties":{"description":{"type":"string","description":"Description of what the browser API tool does."},"id":{"type":"string","description":"Unique identifier for the browser API tool."},"schema":{"description":"JSON Schema defining the tool parameters (JsonSchema7Type)."}},"required":["id","description","schema"]},"description":"Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side."},"capabilities":{"type":"object","properties":{"visualizations":{"type":"boolean","description":"When true, allows the agent to render tabular data from tool results as interactive visualizations using custom XML elements in responses."}},"description":"Controls agent capabilities during conversation. Currently supports visualization rendering for tabular tool results."},"configuration_overrides":{"type":"object","properties":{"instructions":{"type":"string","description":"Custom instructions for the agent."},"tools":{"type":"array","items":{"type":"object","properties":{"tool_ids":{"type":"array","items":{"type":"string"}}},"required":["tool_ids"]},"description":"Tool selection to enable for this execution."}},"description":"Runtime configuration overrides. These override the stored agent configuration for this execution only."},"connector_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one."},"conversation_id":{"type":"string","description":"Optional existing conversation ID to continue a previous conversation."},"execution_id":{"type":"string","description":"Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID."},"inference_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`."},"input":{"type":"string","description":"The user input message to send to the agent."},"prompts":{"type":"object","additionalProperties":{"oneOf":[{"type":"object","properties":{"allow":{"type":"boolean"}},"required":["allow"]},{"type":"object","properties":{"authorized":{"type":"boolean"}},"required":["authorized"]},{"type":"object","properties":{"answers":{"type":"array","items":{"type":"object","properties":{"choice":{"type":"array","items":{"type":"number"}},"custom":{"type":"string"},"skipped":{"type":"boolean"}}}}},"required":["answers"]}]},"description":"Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-converse"}

package/src/kibana/json/post_agent_builder_converse_async.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"_execution_mode":{"enum":["local","task_manager"],"description":"**Experimental; added in 9.4.0.** define how to execute the agent (local execution or via task_manager)"},"action":{"enum":["regenerate"],"description":"The action to perform. \"regenerate\" re-executes the last round with the original input. Requires conversation_id."},"agent_id":{"type":"string","description":"The ID of the agent to chat with. Defaults to the default Elastic AI agent."},"attachments":{"type":"array","items":{"type":"object","properties":{"data":{"type":"object","additionalProperties":{},"description":"Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time)."},"description":{"type":"string","description":"Human-readable label for the attachment."},"group_id":{"type":"string","description":"Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity."},"hidden":{"type":"boolean","description":"When true, the attachment will not be displayed in the UI."},"id":{"type":"string","description":"Optional id for the attachment."},"origin":{"type":"string","description":"Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook."},"type":{"type":"string","description":"Type of the attachment."}},"required":["type"]},"description":"**Technical Preview; added in 9.3.0.** Optional attachments to send with the message."},"browser_api_tools":{"type":"array","items":{"type":"object","properties":{"description":{"type":"string","description":"Description of what the browser API tool does."},"id":{"type":"string","description":"Unique identifier for the browser API tool."},"schema":{"description":"JSON Schema defining the tool parameters (JsonSchema7Type)."}},"required":["id","description","schema"]},"description":"Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side."},"capabilities":{"type":"object","properties":{"visualizations":{"type":"boolean","description":"When true, allows the agent to render tabular data from tool results as interactive visualizations using custom XML elements in responses."}},"description":"Controls agent capabilities during conversation. Currently supports visualization rendering for tabular tool results."},"configuration_overrides":{"type":"object","properties":{"instructions":{"type":"string","description":"Custom instructions for the agent."},"tools":{"type":"array","items":{"type":"object","properties":{"tool_ids":{"type":"array","items":{"type":"string"}}},"required":["tool_ids"]},"description":"Tool selection to enable for this execution."}},"description":"Runtime configuration overrides. These override the stored agent configuration for this execution only."},"connector_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one."},"conversation_id":{"type":"string","description":"Optional existing conversation ID to continue a previous conversation."},"execution_id":{"type":"string","description":"Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID."},"inference_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`."},"input":{"type":"string","description":"The user input message to send to the agent."},"prompts":{"type":"object","additionalProperties":{"oneOf":[{"type":"object","properties":{"allow":{"type":"boolean"}},"required":["allow"]},{"type":"object","properties":{"authorized":{"type":"boolean"}},"required":["authorized"]},{"type":"object","properties":{"answers":{"type":"array","items":{"type":"object","properties":{"choice":{"type":"array","items":{"type":"number"}},"custom":{"type":"string"},"skipped":{"type":"boolean"}}}}},"required":["answers"]}]},"description":"Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-converse-async"}

package/src/kibana/json/post_agent_builder_mcp.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"namespace":{"type":"string","description":"Comma-separated list of namespaces to filter tools. Only tools matching the specified namespaces will be returned.","x-found-in":"query"}},"allOf":[{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-mcp"}

package/src/kibana/json/post_agent_builder_plugins_install.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"plugin_name":{"type":"string","description":"Optional name override for the plugin. Defaults to the manifest name."},"url":{"type":"string","description":"URL to install the plugin from (GitHub URL or direct zip URL)."}},"required":["url"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-plugins-install"}

package/src/kibana/json/post_agent_builder_skills.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"content":{"type":"string","description":"Skill instructions content (markdown)."},"description":{"type":"string","description":"Description of what the skill does."},"id":{"type":"string","description":"Unique identifier for the skill."},"name":{"type":"string","description":"Human-readable name for the skill."},"referenced_content":{"type":"array","items":{"type":"object","properties":{"content":{"type":"string","description":"Content of the reference."},"name":{"type":"string","description":"Name of the referenced content."},"relativePath":{"type":"string","description":"Relative path of the referenced content."}},"required":["name","relativePath","content"]}},"tool_ids":{"type":"array","items":{"type":"string"},"description":"Tool IDs from the tool registry that this skill references."}},"required":["id","name","description","content"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-skills"}

package/src/kibana/json/post_agent_builder_tools.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"configuration":{"type":"object","additionalProperties":{},"description":"Tool-specific configuration parameters. See examples for details."},"description":{"type":"string","description":"Description of what the tool does."},"id":{"type":"string","description":"Unique identifier for the tool."},"tags":{"type":"array","items":{"type":"string"},"description":"Optional tags for categorizing and organizing tools."},"type":{"enum":["esql","index_search","workflow","mcp"],"description":"The type of tool to create (e.g., esql, index_search)."}},"required":["id","type","configuration"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-tools"}

package/src/kibana/json/post_agent_builder_tools_execute.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"connector_id":{"type":"string","description":"Optional connector ID for tools that require external integrations."},"tool_id":{"type":"string","description":"The ID of the tool to execute."},"tool_params":{"type":"object","additionalProperties":{},"description":"Parameters to pass to the tool execution. See examples for details"}},"required":["tool_id","tool_params"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-tools-execute"}

package/src/kibana/json/post_alerting_rule_id.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule. If it is omitted, an ID is randomly generated.","x-found-in":"path"}},"required":["id"],"allOf":[{"type":"object","properties":{"actions":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_rule_action"}},"alert_delay":{"type":"object","properties":{"active":{"type":"number","description":"The number of consecutive runs that must meet the rule conditions."}},"required":["active"],"description":"Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."},"artifacts":{"type":"object","properties":{"dashboards":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]}},"investigation_guide":{"type":"object","properties":{"blob":{"type":"string"}},"required":["blob"]}}},"consumer":{"type":"string","description":"The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."},"enabled":{"type":"boolean","description":"Indicates whether you want the rule to run on an interval basis after it is created."},"flapping":{"oneOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_rule_flapping"},{"type":"null"}]},"name":{"type":"string","description":"The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."},"notify_when":{"enum":["onActionGroupChange","onActiveAlert","onThrottleInterval",null,null],"description":"Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."},"params":{"type":"object","additionalProperties":{},"description":"The parameters for the rule."},"rule_type_id":{"type":"string","description":"The rule type identifier."},"schedule":{"type":"object","properties":{"interval":{"type":"string","description":"The interval is specified in seconds, minutes, hours, or days."}},"required":["interval"],"description":"The check interval, which specifies how frequently the rule conditions are checked."},"tags":{"type":"array","items":{"type":"string"},"description":"The tags for the rule."},"throttle":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."}},"required":["name","consumer","schedule","rule_type_id"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id"}

package/src/kibana/json/post_alerting_rule_id.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_rule_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id"}

package/src/kibana/json/post_alerting_rule_id_disable.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"allOf":[{"oneOf":[{"type":"object","properties":{"untrack":{"type":"boolean","description":"Defines whether this rule's alerts should be untracked."}}},{"type":"null"}]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-disable"}

package/src/kibana/json/post_alerting_rule_id_enable.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-enable"}

package/src/kibana/json/post_alerting_rule_id_mute_all.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-mute-all"}

package/src/kibana/json/post_alerting_rule_id_snooze_schedule.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"Identifier of the rule.","x-found-in":"path"}},"required":["id"],"allOf":[{"type":"object","properties":{"schedule":{"type":"object","properties":{"custom":{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_schedule_request"}}}},"required":["schedule"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-snooze-schedule"}

package/src/kibana/json/post_alerting_rule_id_snooze_schedule.response.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"body":{"type":"object","properties":{"schedule":{"type":"object","properties":{"custom":{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_schedule_request"},"id":{"type":"string","description":"Identifier of the snooze schedule."}},"required":["id"]}},"required":["schedule"]}},"required":["body"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-snooze-schedule"}

package/src/kibana/json/post_alerting_rule_id_unmute_all.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-unmute-all"}

package/src/kibana/json/post_alerting_rule_id_update_api_key.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-update-api-key"}

package/src/kibana/json/post_alerting_rule_rule_id_alert_alert_id_mute.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"rule_id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"},"alert_id":{"type":"string","description":"The identifier for the alert.","x-found-in":"path"},"validate_alerts_existence":{"type":"boolean","description":"Whether to validate the existence of the alert.","x-found-in":"query"}},"required":["rule_id","alert_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-rule-id-alert-alert-id-mute"}

package/src/kibana/json/post_alerting_rule_rule_id_alert_alert_id_unmute.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"rule_id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"},"alert_id":{"type":"string","description":"The identifier for the alert.","x-found-in":"path"}},"required":["rule_id","alert_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-rule-id-alert-alert-id-unmute"}

package/src/kibana/json/post_alerting_rules_backfill_find.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"end":{"type":"string","description":"The end date for filtering backfills.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"per_page":{"type":"number","description":"The number of backfills to return per page.","x-found-in":"query"},"rule_ids":{"type":"string","description":"A comma-separated list of rule identifiers.","x-found-in":"query"},"initiator":{"type":"string","description":"The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills.","x-found-in":"query"},"start":{"type":"string","description":"The start date for filtering backfills.","x-found-in":"query"},"sort_field":{"type":"string","description":"The field to sort backfills by.","x-found-in":"query"},"sort_order":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rules-backfill-find"}

package/src/kibana/json/post_alerting_rules_backfill_find.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_find_backfill_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rules-backfill-find"}

package/src/kibana/json/post_alerting_rules_backfill_schedule.request.json

@@ -1 +0,0 @@
-{"type":"array","items":{"type":"object","properties":{"ranges":{"type":"array","items":{"type":"object","properties":{"end":{"type":"string"},"start":{"type":"string"}},"required":["start","end"]}},"rule_id":{"type":"string"},"run_actions":{"type":"boolean"}},"required":["rule_id","ranges"]},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rules-backfill-schedule"}

package/src/kibana/json/post_alerting_rules_backfill_schedule.response.json

@@ -1 +0,0 @@
-{"type":"array","items":{"oneOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_backfill_response"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_backfill_error_response"}]},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rules-backfill-schedule"}

package/src/kibana/json/post_attack_discovery_bulk.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"update":{"type":"object","properties":{"enable_field_rendering":{"type":"boolean","description":"Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`."},"ids":{"type":"array","items":{"type":"string"},"description":"Array of Attack Discovery IDs to update"},"kibana_alert_workflow_status":{"enum":["open","acknowledged","closed"],"description":"When provided, update the kibana.alert.workflow_status of the attack discovery alerts"},"visibility":{"enum":["not_shared","shared"],"description":"When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field"},"with_replacements":{"type":"boolean","description":"When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`."}},"required":["ids"],"description":"Configuration object containing all parameters for the bulk update operation"}},"required":["update"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryBulk"}

package/src/kibana/json/post_attack_discovery_bulk.response.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Attack_discovery_API_AttackDiscoveryApiAlert"},"description":"Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request."}},"required":["data"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryBulk"}

package/src/kibana/json/post_attack_discovery_generate.request.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Security_Attack_discovery_API_AttackDiscoveryGenerationConfig","$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryGenerate"}

package/src/kibana/json/post_attack_discovery_generate.response.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"execution_uuid":{"$ref":"./_defs.json#/$defs/Security_Attack_discovery_API_NonEmptyString","description":"The unique identifier for the attack discovery generation process. Use this UUID to track the generation progress and retrieve results via the find endpoint."}},"required":["execution_uuid"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryGenerate"}

package/src/kibana/json/post_attack_discovery_generations_dismiss.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"execution_uuid":{"type":"string","description":"The unique identifier for the Attack Discovery generation execution. This UUID is returned when an Attack Discovery generation is created and can be found in generation responses.","x-found-in":"path"}},"required":["execution_uuid"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryGenerationsDismiss"}

package/src/kibana/json/post_attack_discovery_generations_dismiss.response.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"alerts_context_count":{"type":"number","description":"The number of alerts that were sent as context to the LLM for this generation."},"connector_id":{"type":"string","description":"The unique identifier of the connector used to generate the attack discoveries."},"connector_stats":{"type":"object","properties":{"average_successful_duration_nanoseconds":{"type":"number","description":"The average duration in nanoseconds for successful generations using this connector by the current user."},"successful_generations":{"type":"number","description":"The total number of Attack discoveries successfully created for this generation"}},"description":"Statistical information about the connector's performance for this user, providing insights into usage patterns and success rates."},"discoveries":{"type":"number","description":"The number of attack discoveries that were generated during this execution."},"end":{"type":"string","description":"The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven't finished."},"execution_uuid":{"type":"string","description":"The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls."},"loading_message":{"type":"string","description":"A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing."},"reason":{"type":"string","description":"Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process."},"start":{"type":"string","description":"The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis."},"status":{"enum":["canceled","dismissed","failed","started","succeeded"],"description":"The current status of the attack discovery generation. After dismissing, this will be set to \"dismissed\"."}},"required":["connector_id","discoveries","execution_uuid","loading_message","start","status"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PostAttackDiscoveryGenerationsDismiss"}

package/src/kibana/json/post_fleet_agent_download_sources.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"auth":{"oneOf":[{"type":"object","properties":{"api_key":{"type":"string"},"headers":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}},"required":["key","value"]}},"password":{"type":"string"},"username":{"type":"string"}}},{"type":"null"}]},"host":{"type":"string"},"id":{"type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"proxy_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"The ID of the proxy to use for this download source. See the proxies API for more information."},"secrets":{"type":"object","properties":{"auth":{"type":"object","properties":{"api_key":{"oneOf":[{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},{"type":"string"}]},"password":{"oneOf":[{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},{"type":"string"}]}}},"ssl":{"type":"object","properties":{"key":{"oneOf":[{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},{"type":"string"}]}}}}},"ssl":{"type":"object","properties":{"certificate":{"type":"string"},"certificate_authorities":{"type":"array","items":{"type":"string"}},"key":{"type":"string"}}}},"required":["name","host"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-agent-download-sources"}

package/src/kibana/json/post_fleet_agent_download_sources.response.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"item":{"type":"object","properties":{"auth":{"oneOf":[{"type":"object","properties":{"api_key":{"type":"string"},"headers":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}},"required":["key","value"]}},"password":{"type":"string"},"username":{"type":"string"}}},{"type":"null"}]},"host":{"type":"string"},"id":{"type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"proxy_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"The ID of the proxy to use for this download source. See the proxies API for more information."},"secrets":{"type":"object","properties":{"auth":{"type":"object","properties":{"api_key":{"oneOf":[{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},{"type":"string"}]},"password":{"oneOf":[{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},{"type":"string"}]}}},"ssl":{"type":"object","properties":{"key":{"oneOf":[{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},{"type":"string"}]}}}}},"ssl":{"type":"object","properties":{"certificate":{"type":"string"},"certificate_authorities":{"type":"array","items":{"type":"string"}},"key":{"type":"string"}}}},"required":["id","name","host"]}},"required":["item"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-agent-download-sources"}

package/src/kibana/json/post_fleet_agent_policies.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"sys_monitoring":{"type":"boolean","description":"Whether to add the system integration to the new agent policy","x-found-in":"query"}},"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_agent_policy"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-agent-policies"}

package/src/kibana/json/post_fleet_agent_policies.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_get_agent_policy_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-agent-policies"}

package/src/kibana/json/post_fleet_agent_policies_agentpolicyid_copy.request.json

@@ -1 +0,0 @@
-{"type":"object","properties":{"agentPolicyId":{"type":"string","description":"The ID of the agent policy","x-found-in":"path"},"format":{"type":"string","description":"Format for the response: simplified or legacy","x-found-in":"query"}},"required":["agentPolicyId"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_copy_agent_policy_request"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-agent-policies-agentpolicyid-copy"}

package/src/kibana/json/post_fleet_agent_policies_agentpolicyid_copy.response.json

@@ -1 +0,0 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_get_agent_policy_response","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-agent-policies-agentpolicyid-copy"}