npm - @elastic/schemas - Versions diffs - 0.7.2 → 0.7.3 - Mend

@elastic/schemas 0.7.2 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (144) hide show

package/src/kibana/json/agent-builder.post-agent-builder-tools-execute.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-tools-execute","x-api":{"id":"agent-builder.post-agent-builder-tools-execute","name":"post-agent-builder-tools-execute","namespace":"agent-builder"},"x-method":"POST","x-path":"/api/agent_builder/tools/_execute","x-destructive":true,"type":"object","properties":{"connector_id":{"type":"string","description":"Optional connector ID for tools that require external integrations.","x-found-in":"body"},"tool_id":{"type":"string","description":"The ID of the tool to execute.","x-found-in":"body"},"tool_params":{"type":"object","additionalProperties":{},"description":"Parameters to pass to the tool execution. See examples for details","x-found-in":"body"}},"required":["tool_id","tool_params"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-tools-execute","x-api":{"id":"agent-builder.post-agent-builder-tools-execute","name":"post-agent-builder-tools-execute","namespace":"agent-builder"},"x-method":"POST","x-path":"/api/agent_builder/tools/_execute","x-destructive":true,"type":"object","properties":{"approvals":{"type":"object","properties":{"auto_approved_apis":{"type":"object","properties":{"elasticsearch":{"type":"array","items":{"type":"string"},"description":"Elasticsearch APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `indices.create`), a namespace wildcard (for example `indices.`), or `` for every Elasticsearch API."},"kibana":{"type":"array","items":{"type":"string"},"description":"Kibana APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `alerting.delete-alerting-rule-id`), a namespace wildcard (for example `alerting.`), or `` for every Kibana API."}},"description":"Destructive Elasticsearch or Kibana APIs the tool may call without a user confirmation, keyed by backend. A tool run has no live user to answer the confirmation prompt, so a destructive API is refused unless it is listed here."}},"description":"Actions the tool run may take that would otherwise need a live user to approve them. Applies to this run and any sub-agents it spawns.","x-found-in":"body"},"connector_id":{"type":"string","description":"Optional connector ID for tools that require external integrations.","x-found-in":"body"},"tool_id":{"type":"string","description":"The ID of the tool to execute.","x-found-in":"body"},"tool_params":{"type":"object","additionalProperties":{},"description":"Parameters to pass to the tool execution. See examples for details","x-found-in":"body"}},"required":["tool_id","tool_params"]}

package/src/kibana/json/security-entity-analytics-api.configure-risk-engine-saved-object.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"configure-risk-engine-saved-object","x-api":{"id":"security-entity-analytics-api.configure-risk-engine-saved-object","name":"configure-risk-engine-saved-object","namespace":"security-entity-analytics-api"},"x-method":"~~PATCH~~","x-path":"/api/risk_score/engine/saved_object/configure","x-destructive":true,"type":"object","properties":{"enable_reset_to_zero":{"type":"boolean","x-found-in":"body"},"exclude_alert_statuses":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"exclude_alert_tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"filters":{"type":"array","items":{"type":"object","properties":{"entity_types":{"type":"array","items":{"enum":["host","user","service"]}},"filter":{"type":"string","description":"KQL filter string"}},"required":["entity_types","filter"]},"x-found-in":"body"},"page_size":{"type":"number","description":"Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES\|QL result limit (10,000 by default).\n","x-found-in":"body"},"range":{"type":"object","properties":{"end":{"type":"string"},"start":{"type":"string"}},"x-found-in":"body"}}}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"configure-risk-engine-saved-object","x-api":{"id":"security-entity-analytics-api.configure-risk-engine-saved-object","name":"configure-risk-engine-saved-object","namespace":"security-entity-analytics-api"},"x-method":"PUT","x-path":"/api/risk_score/engine/saved_object/configure","x-destructive":true,"type":"object","properties":{"enable_reset_to_zero":{"type":"boolean","x-found-in":"body"},"exclude_alert_statuses":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"exclude_alert_tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"filters":{"type":"array","items":{"type":"object","properties":{"entity_types":{"type":"array","items":{"enum":["host","user","service"]}},"filter":{"type":"string","description":"KQL filter string"}},"required":["entity_types","filter"]},"x-found-in":"body"},"page_size":{"type":"number","description":"Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES\|QL result limit (10,000 by default).\n","x-found-in":"body"},"range":{"type":"object","properties":{"end":{"type":"string"},"start":{"type":"string"}},"x-found-in":"body"}}}

package/src/kibana/json/security-entity-store.post-security-entity-store-entities-entitytype.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.post-security-entity-store-entities-entitytype","name":"post-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":false,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to create.","x-found-in":"path"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.post-security-entity-store-entities-entitytype","name":"post-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":false,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to create.","x-found-in":"path"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}

package/src/kibana/json/security-entity-store.put-security-entity-store-entities-bulk.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-bulk","x-api":{"id":"security-entity-store.put-security-entity-store-entities-bulk","name":"put-security-entity-store-entities-bulk","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/bulk","x-destructive":true,"type":"object","properties":{"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"entities":{"type":"array","items":{"type":"object","properties":{"doc":{"oneOf":[{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}}]},"type":{"enum":["user","host","service","generic"],"description":"The entity type of this record."}},"required":["type"]},"description":"The entities to update.","x-found-in":"body"}},"required":["entities"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-bulk","x-api":{"id":"security-entity-store.put-security-entity-store-entities-bulk","name":"put-security-entity-store-entities-bulk","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/bulk","x-destructive":true,"type":"object","properties":{"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"entities":{"type":"array","items":{"type":"object","properties":{"doc":{"oneOf":[{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}},{"type":"object","properties":{"@timestamp":{"type":"string"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}}},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}}},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}}},"event":{"type":"object","properties":{"ingested":{"type":"string"}}},"labels":{"type":"object","properties":{},"additionalProperties":{}},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}}},"tags":{"type":"array","items":{"type":"string"}}}}]},"type":{"enum":["user","host","service","generic"],"description":"The entity type of this record."}},"required":["type"]},"description":"The entities to update.","x-found-in":"body"}},"required":["entities"]}

package/src/kibana/json/security-entity-store.put-security-entity-store-entities-entitytype.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.put-security-entity-store-entities-entitytype","name":"put-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":true,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to update.","x-found-in":"path"},"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.put-security-entity-store-entities-entitytype","name":"put-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"PUT","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":true,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to update.","x-found-in":"path"},"force":{"oneOf":[{"enum":["true","false"]},{"type":"boolean"}],"description":"When true, allows updating protected fields.","x-found-in":"query"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}

package/src/serverless/json/create_traffic_filter.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"createTrafficFilter","x-api":{"id":"traffic-filters.create-traffic-filter","name":"create-traffic-filter","namespace":"traffic-filters"},"x-method":"POST","x-path":"/api/v1/serverless/traffic-filters","x-destructive":true,"type":"object","properties":{"name":{"type":"string","x-found-in":"body"},"description":{"type":"string","x-found-in":"body"},"type":{"enum":["ip","vpce","private_endpoint"],"x-found-in":"body"},"include_by_default":{"type":"boolean","x-found-in":"body"},"region":{"type":"string","x-found-in":"body"},"rules":{"type":"array","items":{"type":"object","properties":{"description":{"type":"string"},"source":{"type":"string"},"azure_endpoint_name":{"type":"string"},"azure_endpoint_guid":{"type":"string"}}},"x-found-in":"body"}},"required":["name","region","type"]}
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"createTrafficFilter","x-api":{"id":"traffic-filters.create-traffic-filter","name":"create-traffic-filter","namespace":"traffic-filters"},"x-method":"POST","x-path":"/api/v1/serverless/traffic-filters","x-destructive":true,"type":"object","properties":{"organization_id":{"type":"string","description":"The Organization ID to scope the request to.","x-found-in":"query","x-query-serialization":{"style":"form","explode":true}},"name":{"type":"string","x-found-in":"body"},"description":{"type":"string","x-found-in":"body"},"type":{"enum":["ip","vpce","private_endpoint"],"x-found-in":"body"},"include_by_default":{"type":"boolean","x-found-in":"body"},"region":{"type":"string","x-found-in":"body"},"rules":{"type":"array","items":{"type":"object","properties":{"description":{"type":"string"},"source":{"type":"string"},"azure_endpoint_name":{"type":"string"},"azure_endpoint_guid":{"type":"string"}}},"x-found-in":"body"}},"required":["organization_id","name","region","type"]}

package/src/serverless/json/get_organization_capabilities.request.json ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getOrganizationCapabilities","x-api":{"id":"capabilities.get-organization-capabilities","name":"get-organization-capabilities","namespace":"capabilities"},"x-method":"GET","x-path":"/api/v1/serverless/capabilities","x-destructive":false,"type":"object","properties":{}}

package/src/serverless/json/get_organization_capabilities.response.json ADDED Viewed

@@ -0,0 +1 @@

+ {"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getOrganizationCapabilities","x-api":{"id":"capabilities.get-organization-capabilities","name":"get-organization-capabilities","namespace":"capabilities"},"type":"object","properties":{"cross_project_search":{"type":"object","properties":{"max_linked_projects":{"type":"number"}},"required":["max_linked_projects"]}},"required":["cross_project_search"]}