npm - @elastic/schemas - Versions diffs - 0.7.1 → 0.7.3 - Mend

@elastic/schemas 0.7.1 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1265) hide show

package/src/kibana/json/security-entity-store.post-security-entity-store-entities-entitytype.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.post-security-entity-store-entities-entitytype","name":"post-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":false,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to create.","x-found-in":"path"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.post-security-entity-store-entities-entitytype","name":"post-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":false,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to create.","x-found-in":"path"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}

package/src/kibana/json/security-entity-store.put-security-entity-store-entities-bulk.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-bulk","x-api":{"id":"security-entity-store.put-security-entity-store-entities-bulk","name":"put-security-entity-store-entities-bulk","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/bulk","x-destructive":true,"type":"object","properties":{"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"entities":{"type":"array","items":{"type":"object","properties":{"doc":{"oneOf":[{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}}]},"type":{"enum":["user","host","service","generic"],"description":"The entity type of this record."}},"required":["type"]},"description":"The entities to update.","x-found-in":"body"}},"required":["entities"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-bulk","x-api":{"id":"security-entity-store.put-security-entity-store-entities-bulk","name":"put-security-entity-store-entities-bulk","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/bulk","x-destructive":true,"type":"object","properties":{"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"entities":{"type":"array","items":{"type":"object","properties":{"doc":{"oneOf":[{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}}]},"type":{"enum":["user","host","service","generic"],"description":"The entity type of this record."}},"required":["type"]},"description":"The entities to update.","x-found-in":"body"}},"required":["entities"]}

package/src/kibana/json/security-entity-store.put-security-entity-store-entities-entitytype.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.put-security-entity-store-entities-entitytype","name":"put-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":true,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to update.","x-found-in":"path"},"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.put-security-entity-store-entities-entitytype","name":"put-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":true,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to update.","x-found-in":"path"},"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}

package/src/serverless/json/create_traffic_filter.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"createTrafficFilter","x-api":{"id":"traffic-filters.create-traffic-filter","name":"create-traffic-filter","namespace":"traffic-filters"},"x-method":"POST","x-path":"/api/v1/serverless/traffic-filters","x-destructive":true,"type":"object","properties":{"name":{"type":"string","x-found-in":"body"},"description":{"type":"string","x-found-in":"body"},"type":{"enum":["ip","vpce","private_endpoint"],"x-found-in":"body"},"include_by_default":{"type":"boolean","x-found-in":"body"},"region":{"type":"string","x-found-in":"body"},"rules":{"type":"array","items":{"type":"object","properties":{"description":{"type":"string"},"source":{"type":"string"},"azure_endpoint_name":{"type":"string"},"azure_endpoint_guid":{"type":"string"}}},"x-found-in":"body"}},"required":["name","region","type"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"createTrafficFilter","x-api":{"id":"traffic-filters.create-traffic-filter","name":"create-traffic-filter","namespace":"traffic-filters"},"x-method":"POST","x-path":"/api/v1/serverless/traffic-filters","x-destructive":true,"type":"object","properties":{"organization_id":{"type":"string","description":"The Organization ID to scope the request to.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"name":{"type":"string","x-found-in":"body"},"description":{"type":"string","x-found-in":"body"},"type":{"enum":["ip","vpce","private_endpoint"],"x-found-in":"body"},"include_by_default":{"type":"boolean","x-found-in":"body"},"region":{"type":"string","x-found-in":"body"},"rules":{"type":"array","items":{"type":"object","properties":{"description":{"type":"string"},"source":{"type":"string"},"azure_endpoint_name":{"type":"string"},"azure_endpoint_guid":{"type":"string"}}},"x-found-in":"body"}},"required":["organization_id","name","region","type"]}

package/src/serverless/json/get_organization_capabilities.request.json ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getOrganizationCapabilities","x-api":{"id":"capabilities.get-organization-capabilities","name":"get-organization-capabilities","namespace":"capabilities"},"x-method":"GET","x-path":"/api/v1/serverless/capabilities","x-destructive":false,"type":"object","properties":{}}

package/src/serverless/json/get_organization_capabilities.response.json ADDED Viewed

@@ -0,0 +1 @@

+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getOrganizationCapabilities","x-api":{"id":"capabilities.get-organization-capabilities","name":"get-organization-capabilities","namespace":"capabilities"},"type":"object","properties":{"cross_project_search":{"type":"object","properties":{"max_linked_projects":{"type":"number"}},"required":["max_linked_projects"]}},"required":["cross_project_search"]}

package/src/serverless/json/get_traffic_filter.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getTrafficFilter","x-api":{"id":"traffic-filters.get-traffic-filter","name":"get-traffic-filter","namespace":"traffic-filters"},"x-method":"GET","x-path":"/api/v1/serverless/traffic-filters/{id}","x-destructive":false,"type":"object","properties":{"id":{"type":"string","description":"The traffic filter ID.","x-found-in":"path"}},"required":["id"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getTrafficFilter","x-api":{"id":"traffic-filters.get-traffic-filter","name":"get-traffic-filter","namespace":"traffic-filters"},"x-method":"GET","x-path":"/api/v1/serverless/traffic-filters/{id}","x-destructive":false,"type":"object","properties":{"id":{"type":"string","description":"The traffic filter ID.","x-found-in":"path"},"organization_id":{"type":"string","description":"The Organization ID to scope the request to.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}}},"required":["id","organization_id"]}

package/src/serverless/json/get_traffic_filter_metadata.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getTrafficFilterMetadata","x-api":{"id":"traffic-filters.get-traffic-filter-metadata","name":"get-traffic-filter-metadata","namespace":"traffic-filters"},"x-method":"GET","x-path":"/api/v1/serverless/traffic-filters/metadata","x-destructive":false,"type":"object","properties":{"region":{"type":"string","description":"Filter metadata to a specific region (e.g. aws-eu-west-1, azure-australiaeast).","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"csp":{"type":"string","description":"Filter metadata to a specific cloud service provider (aws, azure, gcp).","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}}}}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getTrafficFilterMetadata","x-api":{"id":"traffic-filters.get-traffic-filter-metadata","name":"get-traffic-filter-metadata","namespace":"traffic-filters"},"x-method":"GET","x-path":"/api/v1/serverless/traffic-filters/metadata","x-destructive":false,"type":"object","properties":{"region":{"type":"string","description":"Filter metadata to a specific region (e.g. aws-eu-west-1, azure-australiaeast).","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"csp":{"type":"string","description":"Filter metadata to a specific cloud service provider (aws, azure, gcp).","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"organization_id":{"type":"string","description":"The Organization ID to scope the request to.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}}},"required":["organization_id"]}

package/src/serverless/json/list_traffic_filters.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"listTrafficFilters","x-api":{"id":"traffic-filters.list-traffic-filters","name":"list-traffic-filters","namespace":"traffic-filters"},"x-method":"GET","x-path":"/api/v1/serverless/traffic-filters","x-destructive":false,"type":"object","properties":{"include_by_default":{"type":"boolean","description":"Retrieves a list of resources that have include_by_default set or not set","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"region":{"type":"string","description":"If provided limits the traffic filters to that region only.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}}}}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"listTrafficFilters","x-api":{"id":"traffic-filters.list-traffic-filters","name":"list-traffic-filters","namespace":"traffic-filters"},"x-method":"GET","x-path":"/api/v1/serverless/traffic-filters","x-destructive":false,"type":"object","properties":{"include_by_default":{"type":"boolean","description":"Retrieves a list of resources that have include_by_default set or not set","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"region":{"type":"string","description":"If provided limits the traffic filters to that region only.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"organization_id":{"type":"string","description":"The Organization ID to scope the request to.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}}},"required":["organization_id"]}

package/lib/cjs/kibana/json/cases.add-case-comment-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "add-case-comment-default-space", "x-api": { "id": "cases.add-case-comment-default-space", "name": "add-case-comment-default-space", "namespace": "cases" }, "x-method": "POST", "x-path": "/api/cases/{caseId}/comments", "x-destructive": true, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" }, "body": { "$ref": "./_defs.json#/$defs/Cases_add_case_comment_request", "x-found-in": "body", "x-body-root": true } }, "required": ["caseId"] }

package/lib/cjs/kibana/json/cases.create-case-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "create-case-default-space", "x-api": { "id": "cases.create-case-default-space", "name": "create-case-default-space", "namespace": "cases" }, "x-method": "POST", "x-path": "/api/cases", "x-destructive": true, "type": "object", "properties": { "body": { "$ref": "./_defs.json#/$defs/Cases_create_case_request", "x-found-in": "body", "x-body-root": true } } }

package/lib/cjs/kibana/json/cases.create-case-template-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "create-case-template-default-space", "x-api": { "id": "cases.create-case-template-default-space", "name": "create-case-template-default-space", "namespace": "cases" }, "x-method": "POST", "x-path": "/api/cases/templates", "x-destructive": true, "x-availability": { "serverless": { "stability": "tech_preview" } }, "type": "object", "properties": { "dry_run": { "type": "boolean", "description": "When true, validates the request without creating the template and returns `{\"valid\": true}`.", "x-found-in": "query" }, "body": { "$ref": "./_defs.json#/$defs/Cases_template_write_request", "x-found-in": "body", "x-body-root": true } } }

package/lib/cjs/kibana/json/cases.delete-case-comment-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "delete-case-comment-default-space", "x-api": { "id": "cases.delete-case-comment-default-space", "name": "delete-case-comment-default-space", "namespace": "cases" }, "x-method": "DELETE", "x-path": "/api/cases/{caseId}/comments/{commentId}", "x-destructive": true, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" }, "commentId": { "type": "string", "description": "The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs.\n", "x-found-in": "path" } }, "required": ["caseId", "commentId"] }

package/lib/cjs/kibana/json/cases.delete-case-comments-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "delete-case-comments-default-space", "x-api": { "id": "cases.delete-case-comments-default-space", "name": "delete-case-comments-default-space", "namespace": "cases" }, "x-method": "DELETE", "x-path": "/api/cases/{caseId}/comments", "x-destructive": true, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" } }, "required": ["caseId"] }

package/lib/cjs/kibana/json/cases.delete-case-template-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "delete-case-template-default-space", "x-api": { "id": "cases.delete-case-template-default-space", "name": "delete-case-template-default-space", "namespace": "cases" }, "x-method": "DELETE", "x-path": "/api/cases/templates/{template_id}", "x-destructive": true, "x-availability": { "serverless": { "stability": "tech_preview" } }, "type": "object", "properties": { "template_id": { "type": "string", "description": "The identifier for the template.", "x-found-in": "path" } }, "required": ["template_id"] }

package/lib/cjs/kibana/json/cases.find-case-activity-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "find-case-activity-default-space", "x-api": { "id": "cases.find-case-activity-default-space", "name": "find-case-activity-default-space", "namespace": "cases" }, "x-method": "GET", "x-path": "/api/cases/{caseId}/user_actions/_find", "x-destructive": false, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" }, "page": { "type": "number", "description": "The page number to return.", "x-found-in": "query" }, "perPage": { "type": "number", "description": "The number of items to return. Limited to 100 items.", "x-found-in": "query" }, "sortOrder": { "enum": ["asc", "desc"], "description": "Determines the sort order.", "x-found-in": "query" }, "types": { "type": "array", "items": { "enum": ["action", "alert", "assignees", "attachment", "comment", "connector", "create_case", "description", "pushed", "settings", "severity", "status", "tags", "title", "user"] }, "description": "Determines the types of user actions to return.", "x-found-in": "query" } }, "required": ["caseId"] }

package/lib/cjs/kibana/json/cases.find-case-comments-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "find-case-comments-default-space", "x-api": { "id": "cases.find-case-comments-default-space", "name": "find-case-comments-default-space", "namespace": "cases" }, "x-method": "GET", "x-path": "/api/cases/{caseId}/comments/_find", "x-destructive": false, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" }, "page": { "type": "number", "description": "The page number to return.", "x-found-in": "query" }, "perPage": { "type": "number", "description": "The number of items to return. Limited to 100 items.", "x-found-in": "query" }, "sortOrder": { "enum": ["asc", "desc"], "description": "Determines the sort order.", "x-found-in": "query" } }, "required": ["caseId"] }

package/lib/cjs/kibana/json/cases.get-applicable-fields-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-applicable-fields-default-space", "x-api": { "id": "cases.get-applicable-fields-default-space", "name": "get-applicable-fields-default-space", "namespace": "cases" }, "x-method": "GET", "x-path": "/api/cases/fields", "x-destructive": false, "type": "object", "properties": { "owner": { "type": "string", "description": "The application that owns the cases (for example `cases`, `observability`, or `securitySolution`).", "x-found-in": "query" }, "templateId": { "type": "string", "description": "The identifier of a template to include the template's fields in the response.", "x-found-in": "query" } }, "required": ["owner"] }

package/lib/cjs/kibana/json/cases.get-case-alerts-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-case-alerts-default-space", "x-api": { "id": "cases.get-case-alerts-default-space", "name": "get-case-alerts-default-space", "namespace": "cases" }, "x-method": "GET", "x-path": "/api/cases/{caseId}/alerts", "x-destructive": false, "x-availability": { "serverless": { "stability": "tech_preview" } }, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" } }, "required": ["caseId"] }

package/lib/cjs/kibana/json/cases.get-case-applicable-fields-default-space.request.json DELETED Viewed

@@ -1 +0,0 @@

- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-case-applicable-fields-default-space", "x-api": { "id": "cases.get-case-applicable-fields-default-space", "name": "get-case-applicable-fields-default-space", "namespace": "cases" }, "x-method": "GET", "x-path": "/api/cases/{caseId}/fields", "x-destructive": false, "type": "object", "properties": { "caseId": { "type": "string", "description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.", "x-found-in": "path" } }, "required": ["caseId"] }