npm - @elastic/schemas - Versions diffs - 0.7.2 → 0.7.4 - Mend

@elastic/schemas 0.7.2 → 0.7.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1714) hide show

package/lib/kibana/json/security-entity-store.put-security-entity-store-entities-bulk.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "put-security-entity-store-entities-bulk", "x-api": { "id": "security-entity-store.put-security-entity-store-entities-bulk", "name": "put-security-entity-store-entities-bulk", "namespace": "security-entity-store" }, "x-method": "PUT", "x-path": "/api/security/entity_store/entities/bulk", "x-destructive": true, "type": "object", "properties": { "force": { "oneOf": [{ "enum": ["true", "false"] }, { "type": "boolean" }], "description": "When true, allows updating protected fields.", "x-found-in": "query" }, "entities": { "type": "array", "items": { "type": "object", "properties": { "doc": { "oneOf": [{ "type": "object", "properties": { "@timestamp": { "type": "string" }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string" }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null] }, "environment": { "type": "string" }, "id": { "type": "string" }, "model": { "type": "string" }, "name": { "type": "string" }, "owner": { "type": "string" }, "serial_number": { "type": "string" }, "vendor": { "type": "string" } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean" }, "known_redirects": { "type": "array", "items": { "type": "string" } }, "managed": { "type": "boolean" }, "mfa_enabled": { "type": "boolean" }, "oauth_consent_restriction": { "type": "string" }, "permissions": { "type": "array", "items": { "type": "string" } }, "storage_class": { "type": "string" }, "watchlists": { "type": "array", "items": { "type": "string" } } } }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" } }, "rule_names": { "type": "array", "items": { "type": "string" } } } }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string" } } }, "id": { "type": "string" }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string" }, "last_activity": { "type": "string" }, "last_seen": { "type": "string" } } }, "name": { "type": "string" }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } } } }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "schema_version": { "type": "string" }, "source": { "type": "array", "items": { "type": "string" } }, "sub_type": { "type": "string" }, "type": { "type": "string" }, "url": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {} }, "tags": { "type": "array", "items": { "type": "string" } }, "user": { "type": "object", "properties": { "domain": { "type": "array", "items": { "type": "string" } }, "email": { "type": "array", "items": { "type": "string" } }, "full_name": { "type": "array", "items": { "type": "string" } }, "hash": { "type": "array", "items": { "type": "string" } }, "id": { "type": "array", "items": { "type": "string" } }, "name": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "roles": { "type": "array", "items": { "type": "string" } } } } } }, { "type": "object", "properties": { "@timestamp": { "type": "string" }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string" }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null] }, "environment": { "type": "string" }, "id": { "type": "string" }, "model": { "type": "string" }, "name": { "type": "string" }, "owner": { "type": "string" }, "serial_number": { "type": "string" }, "vendor": { "type": "string" } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean" }, "known_redirects": { "type": "array", "items": { "type": "string" } }, "managed": { "type": "boolean" }, "mfa_enabled": { "type": "boolean" }, "oauth_consent_restriction": { "type": "string" }, "permissions": { "type": "array", "items": { "type": "string" } }, "storage_class": { "type": "string" }, "watchlists": { "type": "array", "items": { "type": "string" } } } }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" } }, "rule_names": { "type": "array", "items": { "type": "string" } } } }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string" } } }, "id": { "type": "string" }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string" }, "last_activity": { "type": "string" }, "last_seen": { "type": "string" } } }, "name": { "type": "string" }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } } } }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "schema_version": { "type": "string" }, "source": { "type": "array", "items": { "type": "string" } }, "sub_type": { "type": "string" }, "type": { "type": "string" }, "url": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } } }, "host": { "type": "object", "properties": { "architecture": { "type": "array", "items": { "type": "string" } }, "domain": { "type": "array", "items": { "type": "string" } }, "hostname": { "type": "array", "items": { "type": "string" } }, "id": { "type": "array", "items": { "type": "string" } }, "ip": { "type": "array", "items": { "type": "string" } }, "mac": { "type": "array", "items": { "type": "string" } }, "name": { "type": "string" }, "os": { "type": "object", "properties": { "family": { "type": "string" }, "full": { "type": "string" }, "kernel": { "type": "string" }, "name": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "platform": { "type": "string" }, "type": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "version": { "type": "string" } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "type": { "type": "array", "items": { "type": "string" } } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {} }, "tags": { "type": "array", "items": { "type": "string" } } } }, { "type": "object", "properties": { "@timestamp": { "type": "string" }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string" }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null] }, "environment": { "type": "string" }, "id": { "type": "string" }, "model": { "type": "string" }, "name": { "type": "string" }, "owner": { "type": "string" }, "serial_number": { "type": "string" }, "vendor": { "type": "string" } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean" }, "known_redirects": { "type": "array", "items": { "type": "string" } }, "managed": { "type": "boolean" }, "mfa_enabled": { "type": "boolean" }, "oauth_consent_restriction": { "type": "string" }, "permissions": { "type": "array", "items": { "type": "string" } }, "storage_class": { "type": "string" }, "watchlists": { "type": "array", "items": { "type": "string" } } } }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" } }, "rule_names": { "type": "array", "items": { "type": "string" } } } }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string" } } }, "id": { "type": "string" }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string" }, "last_activity": { "type": "string" }, "last_seen": { "type": "string" } } }, "name": { "type": "string" }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } } } }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "schema_version": { "type": "string" }, "source": { "type": "array", "items": { "type": "string" } }, "sub_type": { "type": "string" }, "type": { "type": "string" }, "url": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {} }, "service": { "type": "object", "properties": { "address": { "type": "string" }, "environment": { "type": "string" }, "ephemeral_id": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "node": { "type": "object", "properties": { "name": { "type": "string" }, "role": { "type": "string" }, "roles": { "type": "array", "items": { "type": "string" } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "state": { "type": "string" }, "type": { "type": "string" }, "version": { "type": "string" } } }, "tags": { "type": "array", "items": { "type": "string" } } } }, { "type": "object", "properties": { "@timestamp": { "type": "string" }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string" }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null] }, "environment": { "type": "string" }, "id": { "type": "string" }, "model": { "type": "string" }, "name": { "type": "string" }, "owner": { "type": "string" }, "serial_number": { "type": "string" }, "vendor": { "type": "string" } } }, "cloud": { "type": "object", "properties": { "account": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "availability_zone": { "type": "string" }, "instance": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "machine": { "type": "object", "properties": { "type": { "type": "string" } } }, "project": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "provider": { "type": "string" }, "region": { "type": "string" }, "service": { "type": "object", "properties": { "name": { "type": "string" } } } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean" }, "known_redirects": { "type": "array", "items": { "type": "string" } }, "managed": { "type": "boolean" }, "mfa_enabled": { "type": "boolean" }, "oauth_consent_restriction": { "type": "string" }, "permissions": { "type": "array", "items": { "type": "string" } }, "storage_class": { "type": "string" }, "watchlists": { "type": "array", "items": { "type": "string" } } } }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" } }, "rule_names": { "type": "array", "items": { "type": "string" } } } }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string" } } }, "id": { "type": "string" }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string" }, "last_activity": { "type": "string" }, "last_seen": { "type": "string" } } }, "name": { "type": "string" }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } } } }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "schema_version": { "type": "string" }, "source": { "type": "array", "items": { "type": "string" } }, "sub_type": { "type": "string" }, "type": { "type": "string" }, "url": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {} }, "orchestrator": { "type": "object", "properties": { "api_version": { "type": "string" }, "cluster": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "url": { "type": "string" }, "version": { "type": "string" } } }, "namespace": { "type": "string" }, "organization": { "type": "string" }, "resource": { "type": "object", "properties": { "annotation": { "type": "string" }, "id": { "type": "string" }, "ip": { "type": "string" }, "label": { "type": "string" }, "name": { "type": "string" }, "parent": { "type": "object", "properties": { "type": { "type": "string" } } }, "type": { "type": "string" } } }, "type": { "type": "string" } } }, "tags": { "type": "array", "items": { "type": "string" } } } }] }, "type": { "enum": ["user", "host", "service", "generic"], "description": "The entity type of this record." } }, "required": ["type"] }, "description": "The entities to update.", "x-found-in": "body" } }, "required": ["entities"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "put-security-entity-store-entities-bulk", "x-api": { "id": "security-entity-store.put-security-entity-store-entities-bulk", "name": "put-security-entity-store-entities-bulk", "namespace": "security-entity-store" }, "x-method": "PUT", "x-path": "/api/security/entity_store/entities/bulk", "x-destructive": true, "type": "object", "properties": { "force": { "oneOf": [{ "enum": ["true", "false"] }, { "type": "boolean" }], "description": "When true, allows updating protected fields.", "x-found-in": "query" }, "entities": { "type": "array", "items": { "type": "object", "properties": { "doc": { "oneOf": [{ "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated." }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string", "description": "Business unit the asset belongs to." }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null], "description": "The criticality level assigned to this asset." }, "environment": { "type": "string", "description": "Deployment environment (for example, production, staging)." }, "id": { "type": "string", "description": "Unique identifier for the asset." }, "model": { "type": "string", "description": "Model name or number." }, "name": { "type": "string", "description": "Human-readable asset name." }, "owner": { "type": "string", "description": "The owner of the asset." }, "serial_number": { "type": "string", "description": "Serial number of the asset." }, "vendor": { "type": "string", "description": "Vendor or manufacturer." } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean", "description": "Whether the entity is classified as an asset." }, "known_redirects": { "type": "array", "items": { "type": "string" }, "description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)." }, "managed": { "type": "boolean", "description": "Whether the entity is managed (for example, via a directory service)." }, "mfa_enabled": { "type": "boolean", "description": "Whether multi-factor authentication is enabled for the entity." }, "oauth_consent_restriction": { "type": "string", "description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)." }, "permissions": { "type": "array", "items": { "type": "string" }, "description": "Action-level permissions granted to this entity (not roles or groups)." }, "storage_class": { "type": "string", "description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)." }, "watchlists": { "type": "array", "items": { "type": "string" }, "description": "Watchlist identifiers the entity belongs to (v2)." } }, "description": "Boolean flags describing characteristics of the entity." }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" }, "description": "Machine learning anomaly job identifiers (v2)." }, "rule_names": { "type": "array", "items": { "type": "string" }, "description": "Detection rule names that flagged this entity (v2)." } }, "description": "Behavioral signals observed for the entity." }, "created_by": { "type": "string", "description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)." }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string", "description": "The engine type that produced this entity record." } } }, "id": { "type": "string", "description": "Unique identifier for this entity." }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string", "description": "When the entity was first observed." }, "last_activity": { "type": "string", "description": "When the entity last generated activity." }, "last_seen": { "type": "string", "description": "When the entity was last observed." } }, "description": "Timestamps tracking the entity lifecycle." }, "name": { "type": "string", "description": "Human-readable name of the entity." }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses frequently." }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses infrequently." }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity administers (for example, a user who is an admin of a service)." }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity communicates with." }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity depends on." }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities owned by this entity." }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities inferred to be owned by this entity." }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string", "description": "entity.id of the entity this one resolves to" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the resolution group's aggregated risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the resolution group's aggregated risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the resolution group's aggregated risk score." } }, "description": "Aggregated risk score for the resolution group." } }, "description": "Resolution metadata linking this entity to another." }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities supervised by this entity." } }, "description": "Connections between this entity and other entities." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities." } }, "description": "Risk scoring information for the entity." }, "schema_version": { "type": "string", "description": "Schema version of the entity record." }, "source": { "type": "array", "items": { "type": "string" }, "description": "Sources that produced this entity record." }, "sub_type": { "type": "string", "description": "Optional sub-type classification for the entity." }, "type": { "type": "string", "description": "The entity type." }, "url": { "type": "string", "description": "URL associated with the entity." } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string", "description": "When the event was ingested into Elasticsearch." } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {}, "description": "Custom key-value labels attached to the entity." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Tags attached to the entity." }, "user": { "type": "object", "properties": { "domain": { "type": "array", "items": { "type": "string" }, "description": "Observed user domains." }, "email": { "type": "array", "items": { "type": "string" }, "description": "Observed email addresses." }, "full_name": { "type": "array", "items": { "type": "string" }, "description": "Observed full names of the user." }, "hash": { "type": "array", "items": { "type": "string" }, "description": "Observed user hashes." }, "id": { "type": "array", "items": { "type": "string" }, "description": "Observed user identifiers." }, "name": { "type": "string", "description": "Primary user name." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score." } } }, "roles": { "type": "array", "items": { "type": "string" }, "description": "Observed roles assigned to the user." } }, "description": "Elastic Common Schema (ECS) user fields collected on the entity." } } }, { "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated." }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string", "description": "Business unit the asset belongs to." }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null], "description": "The criticality level assigned to this asset." }, "environment": { "type": "string", "description": "Deployment environment (for example, production, staging)." }, "id": { "type": "string", "description": "Unique identifier for the asset." }, "model": { "type": "string", "description": "Model name or number." }, "name": { "type": "string", "description": "Human-readable asset name." }, "owner": { "type": "string", "description": "The owner of the asset." }, "serial_number": { "type": "string", "description": "Serial number of the asset." }, "vendor": { "type": "string", "description": "Vendor or manufacturer." } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean", "description": "Whether the entity is classified as an asset." }, "known_redirects": { "type": "array", "items": { "type": "string" }, "description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)." }, "managed": { "type": "boolean", "description": "Whether the entity is managed (for example, via a directory service)." }, "mfa_enabled": { "type": "boolean", "description": "Whether multi-factor authentication is enabled for the entity." }, "oauth_consent_restriction": { "type": "string", "description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)." }, "permissions": { "type": "array", "items": { "type": "string" }, "description": "Action-level permissions granted to this entity (not roles or groups)." }, "storage_class": { "type": "string", "description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)." }, "watchlists": { "type": "array", "items": { "type": "string" }, "description": "Watchlist identifiers the entity belongs to (v2)." } }, "description": "Boolean flags describing characteristics of the entity." }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" }, "description": "Machine learning anomaly job identifiers (v2)." }, "rule_names": { "type": "array", "items": { "type": "string" }, "description": "Detection rule names that flagged this entity (v2)." } }, "description": "Behavioral signals observed for the entity." }, "created_by": { "type": "string", "description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)." }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string", "description": "The engine type that produced this entity record." } } }, "id": { "type": "string", "description": "Unique identifier for this entity." }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string", "description": "When the entity was first observed." }, "last_activity": { "type": "string", "description": "When the entity last generated activity." }, "last_seen": { "type": "string", "description": "When the entity was last observed." } }, "description": "Timestamps tracking the entity lifecycle." }, "name": { "type": "string", "description": "Human-readable name of the entity." }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses frequently." }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses infrequently." }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity administers (for example, a user who is an admin of a service)." }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity communicates with." }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity depends on." }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities owned by this entity." }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities inferred to be owned by this entity." }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string", "description": "entity.id of the entity this one resolves to" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the resolution group's aggregated risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the resolution group's aggregated risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the resolution group's aggregated risk score." } }, "description": "Aggregated risk score for the resolution group." } }, "description": "Resolution metadata linking this entity to another." }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities supervised by this entity." } }, "description": "Connections between this entity and other entities." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities." } }, "description": "Risk scoring information for the entity." }, "schema_version": { "type": "string", "description": "Schema version of the entity record." }, "source": { "type": "array", "items": { "type": "string" }, "description": "Sources that produced this entity record." }, "sub_type": { "type": "string", "description": "Optional sub-type classification for the entity." }, "type": { "type": "string", "description": "The entity type." }, "url": { "type": "string", "description": "URL associated with the entity." } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string", "description": "When the event was ingested into Elasticsearch." } } }, "host": { "type": "object", "properties": { "architecture": { "type": "array", "items": { "type": "string" }, "description": "Observed CPU architectures." }, "domain": { "type": "array", "items": { "type": "string" }, "description": "Observed host domains." }, "hostname": { "type": "array", "items": { "type": "string" }, "description": "Observed hostnames." }, "id": { "type": "array", "items": { "type": "string" }, "description": "Observed host identifiers." }, "ip": { "type": "array", "items": { "type": "string" }, "description": "Observed IP addresses." }, "mac": { "type": "array", "items": { "type": "string" }, "description": "Observed MAC addresses." }, "name": { "type": "string", "description": "Primary host name." }, "os": { "type": "object", "properties": { "family": { "type": "string" }, "full": { "type": "string" }, "kernel": { "type": "string" }, "name": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "platform": { "type": "string" }, "type": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "version": { "type": "string" } }, "description": "Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2)." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score." } } }, "type": { "type": "array", "items": { "type": "string" }, "description": "Observed host types." } }, "description": "Elastic Common Schema (ECS) host fields collected on the entity." }, "labels": { "type": "object", "properties": {}, "additionalProperties": {}, "description": "Custom key-value labels attached to the entity." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Tags attached to the entity." } } }, { "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated." }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string", "description": "Business unit the asset belongs to." }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null], "description": "The criticality level assigned to this asset." }, "environment": { "type": "string", "description": "Deployment environment (for example, production, staging)." }, "id": { "type": "string", "description": "Unique identifier for the asset." }, "model": { "type": "string", "description": "Model name or number." }, "name": { "type": "string", "description": "Human-readable asset name." }, "owner": { "type": "string", "description": "The owner of the asset." }, "serial_number": { "type": "string", "description": "Serial number of the asset." }, "vendor": { "type": "string", "description": "Vendor or manufacturer." } } }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean", "description": "Whether the entity is classified as an asset." }, "known_redirects": { "type": "array", "items": { "type": "string" }, "description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)." }, "managed": { "type": "boolean", "description": "Whether the entity is managed (for example, via a directory service)." }, "mfa_enabled": { "type": "boolean", "description": "Whether multi-factor authentication is enabled for the entity." }, "oauth_consent_restriction": { "type": "string", "description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)." }, "permissions": { "type": "array", "items": { "type": "string" }, "description": "Action-level permissions granted to this entity (not roles or groups)." }, "storage_class": { "type": "string", "description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)." }, "watchlists": { "type": "array", "items": { "type": "string" }, "description": "Watchlist identifiers the entity belongs to (v2)." } }, "description": "Boolean flags describing characteristics of the entity." }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" }, "description": "Machine learning anomaly job identifiers (v2)." }, "rule_names": { "type": "array", "items": { "type": "string" }, "description": "Detection rule names that flagged this entity (v2)." } }, "description": "Behavioral signals observed for the entity." }, "created_by": { "type": "string", "description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)." }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string", "description": "The engine type that produced this entity record." } } }, "id": { "type": "string", "description": "Unique identifier for this entity." }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string", "description": "When the entity was first observed." }, "last_activity": { "type": "string", "description": "When the entity last generated activity." }, "last_seen": { "type": "string", "description": "When the entity was last observed." } }, "description": "Timestamps tracking the entity lifecycle." }, "name": { "type": "string", "description": "Human-readable name of the entity." }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses frequently." }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses infrequently." }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity administers (for example, a user who is an admin of a service)." }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity communicates with." }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity depends on." }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities owned by this entity." }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities inferred to be owned by this entity." }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string", "description": "entity.id of the entity this one resolves to" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the resolution group's aggregated risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the resolution group's aggregated risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the resolution group's aggregated risk score." } }, "description": "Aggregated risk score for the resolution group." } }, "description": "Resolution metadata linking this entity to another." }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities supervised by this entity." } }, "description": "Connections between this entity and other entities." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities." } }, "description": "Risk scoring information for the entity." }, "schema_version": { "type": "string", "description": "Schema version of the entity record." }, "source": { "type": "array", "items": { "type": "string" }, "description": "Sources that produced this entity record." }, "sub_type": { "type": "string", "description": "Optional sub-type classification for the entity." }, "type": { "type": "string", "description": "The entity type." }, "url": { "type": "string", "description": "URL associated with the entity." } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string", "description": "When the event was ingested into Elasticsearch." } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {}, "description": "Custom key-value labels attached to the entity." }, "service": { "type": "object", "properties": { "address": { "type": "string", "description": "Service address." }, "environment": { "type": "string", "description": "Service environment (for example, production, staging)." }, "ephemeral_id": { "type": "string", "description": "Ephemeral identifier of the service." }, "id": { "type": "string", "description": "Unique identifier of the service." }, "name": { "type": "string", "description": "Primary service name." }, "node": { "type": "object", "properties": { "name": { "type": "string", "description": "Node name." }, "role": { "type": "string", "description": "Node role." }, "roles": { "type": "array", "items": { "type": "string" }, "description": "Node roles." } }, "description": "Node information for the service." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score." } } }, "state": { "type": "string", "description": "Current state of the service." }, "type": { "type": "string", "description": "Service type." }, "version": { "type": "string", "description": "Service version." } }, "description": "Elastic Common Schema (ECS) service fields collected on the entity." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Tags attached to the entity." } } }, { "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated." }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string", "description": "Business unit the asset belongs to." }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null], "description": "The criticality level assigned to this asset." }, "environment": { "type": "string", "description": "Deployment environment (for example, production, staging)." }, "id": { "type": "string", "description": "Unique identifier for the asset." }, "model": { "type": "string", "description": "Model name or number." }, "name": { "type": "string", "description": "Human-readable asset name." }, "owner": { "type": "string", "description": "The owner of the asset." }, "serial_number": { "type": "string", "description": "Serial number of the asset." }, "vendor": { "type": "string", "description": "Vendor or manufacturer." } } }, "cloud": { "type": "object", "properties": { "account": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "availability_zone": { "type": "string" }, "instance": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "machine": { "type": "object", "properties": { "type": { "type": "string" } } }, "project": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "provider": { "type": "string" }, "region": { "type": "string" }, "service": { "type": "object", "properties": { "name": { "type": "string" } } } }, "description": "Elastic Common Schema (ECS) cloud fields for cloud-hosted entities." }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean", "description": "Whether the entity is classified as an asset." }, "known_redirects": { "type": "array", "items": { "type": "string" }, "description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)." }, "managed": { "type": "boolean", "description": "Whether the entity is managed (for example, via a directory service)." }, "mfa_enabled": { "type": "boolean", "description": "Whether multi-factor authentication is enabled for the entity." }, "oauth_consent_restriction": { "type": "string", "description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)." }, "permissions": { "type": "array", "items": { "type": "string" }, "description": "Action-level permissions granted to this entity (not roles or groups)." }, "storage_class": { "type": "string", "description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)." }, "watchlists": { "type": "array", "items": { "type": "string" }, "description": "Watchlist identifiers the entity belongs to (v2)." } }, "description": "Boolean flags describing characteristics of the entity." }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" }, "description": "Machine learning anomaly job identifiers (v2)." }, "rule_names": { "type": "array", "items": { "type": "string" }, "description": "Detection rule names that flagged this entity (v2)." } }, "description": "Behavioral signals observed for the entity." }, "created_by": { "type": "string", "description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)." }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string", "description": "The engine type that produced this entity record." } } }, "id": { "type": "string", "description": "Unique identifier for this entity." }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string", "description": "When the entity was first observed." }, "last_activity": { "type": "string", "description": "When the entity last generated activity." }, "last_seen": { "type": "string", "description": "When the entity was last observed." } }, "description": "Timestamps tracking the entity lifecycle." }, "name": { "type": "string", "description": "Human-readable name of the entity." }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses frequently." }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses infrequently." }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity administers (for example, a user who is an admin of a service)." }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity communicates with." }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity depends on." }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities owned by this entity." }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities inferred to be owned by this entity." }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string", "description": "entity.id of the entity this one resolves to" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the resolution group's aggregated risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the resolution group's aggregated risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the resolution group's aggregated risk score." } }, "description": "Aggregated risk score for the resolution group." } }, "description": "Resolution metadata linking this entity to another." }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities supervised by this entity." } }, "description": "Connections between this entity and other entities." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities." } }, "description": "Risk scoring information for the entity." }, "schema_version": { "type": "string", "description": "Schema version of the entity record." }, "source": { "type": "array", "items": { "type": "string" }, "description": "Sources that produced this entity record." }, "sub_type": { "type": "string", "description": "Optional sub-type classification for the entity." }, "type": { "type": "string", "description": "The entity type." }, "url": { "type": "string", "description": "URL associated with the entity." } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } } }, "labels": { "type": "object", "properties": {}, "additionalProperties": {} }, "orchestrator": { "type": "object", "properties": { "api_version": { "type": "string" }, "cluster": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "url": { "type": "string" }, "version": { "type": "string" } } }, "namespace": { "type": "string" }, "organization": { "type": "string" }, "resource": { "type": "object", "properties": { "annotation": { "type": "string" }, "id": { "type": "string" }, "ip": { "type": "string" }, "label": { "type": "string" }, "name": { "type": "string" }, "parent": { "type": "object", "properties": { "type": { "type": "string" } } }, "type": { "type": "string" } } }, "type": { "type": "string" } }, "description": "Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities." }, "tags": { "type": "array", "items": { "type": "string" } } } }] }, "type": { "enum": ["user", "host", "service", "generic"], "description": "The entity type of this record." } }, "required": ["type"] }, "description": "The entities to update.", "x-found-in": "body" } }, "required": ["entities"] }

package/lib/kibana/json/security-entity-store.put-security-entity-store-entities-entitytype.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "put-security-entity-store-entities-entitytype", "x-api": { "id": "security-entity-store.put-security-entity-store-entities-entitytype", "name": "put-security-entity-store-entities-entitytype", "namespace": "security-entity-store" }, "x-method": "PUT", "x-path": "/api/security/entity_store/entities/{entityType}", "x-destructive": true, "type": "object", "properties": { "entityType": { "type": "string", "description": "The entity type to update.", "x-found-in": "path" }, "force": { "oneOf": [{ "enum": ["true", "false"] }, { "type": "boolean" }], "description": "When true, allows updating protected fields.", "x-found-in": "query" }, "@timestamp": { "type": "string", "x-found-in": "body" }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string" }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null] }, "environment": { "type": "string" }, "id": { "type": "string" }, "model": { "type": "string" }, "name": { "type": "string" }, "owner": { "type": "string" }, "serial_number": { "type": "string" }, "vendor": { "type": "string" } }, "x-found-in": "body" }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean" }, "known_redirects": { "type": "array", "items": { "type": "string" } }, "managed": { "type": "boolean" }, "mfa_enabled": { "type": "boolean" }, "oauth_consent_restriction": { "type": "string" }, "permissions": { "type": "array", "items": { "type": "string" } }, "storage_class": { "type": "string" }, "watchlists": { "type": "array", "items": { "type": "string" } } } }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" } }, "rule_names": { "type": "array", "items": { "type": "string" } } } }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string" } } }, "id": { "type": "string" }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string" }, "last_activity": { "type": "string" }, "last_seen": { "type": "string" } } }, "name": { "type": "string" }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } } } }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "schema_version": { "type": "string" }, "source": { "type": "array", "items": { "type": "string" } }, "sub_type": { "type": "string" }, "type": { "type": "string" }, "url": { "type": "string" } }, "x-found-in": "body" }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } }, "x-found-in": "body" }, "labels": { "type": "object", "properties": {}, "additionalProperties": {}, "x-found-in": "body" }, "tags": { "type": "array", "items": { "type": "string" }, "x-found-in": "body" }, "user": { "type": "object", "properties": { "domain": { "type": "array", "items": { "type": "string" } }, "email": { "type": "array", "items": { "type": "string" } }, "full_name": { "type": "array", "items": { "type": "string" } }, "hash": { "type": "array", "items": { "type": "string" } }, "id": { "type": "array", "items": { "type": "string" } }, "name": { "type": "string" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "roles": { "type": "array", "items": { "type": "string" } } }, "x-found-in": "body" }, "host": { "type": "object", "properties": { "architecture": { "type": "array", "items": { "type": "string" } }, "domain": { "type": "array", "items": { "type": "string" } }, "hostname": { "type": "array", "items": { "type": "string" } }, "id": { "type": "array", "items": { "type": "string" } }, "ip": { "type": "array", "items": { "type": "string" } }, "mac": { "type": "array", "items": { "type": "string" } }, "name": { "type": "string" }, "os": { "type": "object", "properties": { "family": { "type": "string" }, "full": { "type": "string" }, "kernel": { "type": "string" }, "name": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "platform": { "type": "string" }, "type": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "version": { "type": "string" } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "type": { "type": "array", "items": { "type": "string" } } }, "x-found-in": "body" }, "service": { "type": "object", "properties": { "address": { "type": "string" }, "environment": { "type": "string" }, "ephemeral_id": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "node": { "type": "object", "properties": { "name": { "type": "string" }, "role": { "type": "string" }, "roles": { "type": "array", "items": { "type": "string" } } } }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"] }, "calculated_score": { "type": "number" }, "calculated_score_norm": { "type": "number" } } }, "state": { "type": "string" }, "type": { "type": "string" }, "version": { "type": "string" } }, "x-found-in": "body" }, "cloud": { "type": "object", "properties": { "account": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "availability_zone": { "type": "string" }, "instance": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "machine": { "type": "object", "properties": { "type": { "type": "string" } } }, "project": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "provider": { "type": "string" }, "region": { "type": "string" }, "service": { "type": "object", "properties": { "name": { "type": "string" } } } }, "x-found-in": "body" }, "orchestrator": { "type": "object", "properties": { "api_version": { "type": "string" }, "cluster": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "url": { "type": "string" }, "version": { "type": "string" } } }, "namespace": { "type": "string" }, "organization": { "type": "string" }, "resource": { "type": "object", "properties": { "annotation": { "type": "string" }, "id": { "type": "string" }, "ip": { "type": "string" }, "label": { "type": "string" }, "name": { "type": "string" }, "parent": { "type": "object", "properties": { "type": { "type": "string" } } }, "type": { "type": "string" } } }, "type": { "type": "string" } }, "x-found-in": "body" } }, "required": ["entityType"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "put-security-entity-store-entities-entitytype", "x-api": { "id": "security-entity-store.put-security-entity-store-entities-entitytype", "name": "put-security-entity-store-entities-entitytype", "namespace": "security-entity-store" }, "x-method": "PUT", "x-path": "/api/security/entity_store/entities/{entityType}", "x-destructive": true, "type": "object", "properties": { "entityType": { "type": "string", "description": "The entity type to update.", "x-found-in": "path" }, "force": { "oneOf": [{ "enum": ["true", "false"] }, { "type": "boolean" }], "description": "When true, allows updating protected fields.", "x-found-in": "query" }, "@timestamp": { "type": "string", "description": "The time the entity record was last updated.", "x-found-in": "body" }, "asset": { "type": "object", "properties": { "business_unit": { "type": "string", "description": "Business unit the asset belongs to." }, "criticality": { "enum": ["low_impact", "medium_impact", "high_impact", "extreme_impact", null], "description": "The criticality level assigned to this asset." }, "environment": { "type": "string", "description": "Deployment environment (for example, production, staging)." }, "id": { "type": "string", "description": "Unique identifier for the asset." }, "model": { "type": "string", "description": "Model name or number." }, "name": { "type": "string", "description": "Human-readable asset name." }, "owner": { "type": "string", "description": "The owner of the asset." }, "serial_number": { "type": "string", "description": "Serial number of the asset." }, "vendor": { "type": "string", "description": "Vendor or manufacturer." } }, "x-found-in": "body" }, "entity": { "type": "object", "properties": { "attributes": { "type": "object", "properties": { "asset": { "type": "boolean", "description": "Whether the entity is classified as an asset." }, "known_redirects": { "type": "array", "items": { "type": "string" }, "description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)." }, "managed": { "type": "boolean", "description": "Whether the entity is managed (for example, via a directory service)." }, "mfa_enabled": { "type": "boolean", "description": "Whether multi-factor authentication is enabled for the entity." }, "oauth_consent_restriction": { "type": "string", "description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)." }, "permissions": { "type": "array", "items": { "type": "string" }, "description": "Action-level permissions granted to this entity (not roles or groups)." }, "storage_class": { "type": "string", "description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)." }, "watchlists": { "type": "array", "items": { "type": "string" }, "description": "Watchlist identifiers the entity belongs to (v2)." } }, "description": "Boolean flags describing characteristics of the entity." }, "behaviors": { "type": "object", "properties": { "anomaly_job_ids": { "type": "array", "items": { "type": "string" }, "description": "Machine learning anomaly job identifiers (v2)." }, "rule_names": { "type": "array", "items": { "type": "string" }, "description": "Detection rule names that flagged this entity (v2)." } }, "description": "Behavioral signals observed for the entity." }, "created_by": { "type": "string", "description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)." }, "EngineMetadata": { "type": "object", "properties": { "Type": { "type": "string", "description": "The engine type that produced this entity record." } } }, "id": { "type": "string", "description": "Unique identifier for this entity." }, "lifecycle": { "type": "object", "properties": { "first_seen": { "type": "string", "description": "When the entity was first observed." }, "last_activity": { "type": "string", "description": "When the entity last generated activity." }, "last_seen": { "type": "string", "description": "When the entity was last observed." } }, "description": "Timestamps tracking the entity lifecycle." }, "name": { "type": "string", "description": "Human-readable name of the entity." }, "relationships": { "type": "object", "properties": { "accesses_frequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses frequently." }, "accesses_infrequently": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity accesses infrequently." }, "administers": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity administers (for example, a user who is an admin of a service)." }, "communicates_with": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity communicates with." }, "depends_on": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities this entity depends on." }, "owns": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities owned by this entity." }, "owns_inferred": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities inferred to be owned by this entity." }, "resolution": { "type": "object", "properties": { "resolved_to": { "type": "string", "description": "entity.id of the entity this one resolves to" }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the resolution group's aggregated risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the resolution group's aggregated risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the resolution group's aggregated risk score." } }, "description": "Aggregated risk score for the resolution group." } }, "description": "Resolution metadata linking this entity to another." }, "supervises": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters." }, "raw_identifiers": { "type": "object", "properties": { "entity.id": { "type": "array", "items": { "type": "string" } }, "host.id": { "type": "array", "items": { "type": "string" } }, "host.name": { "type": "array", "items": { "type": "string" } }, "service.name": { "type": "array", "items": { "type": "string" } }, "user.email": { "type": "array", "items": { "type": "string" } }, "user.id": { "type": "array", "items": { "type": "string" } }, "user.name": { "type": "array", "items": { "type": "string" } } } } }, "description": "Entities supervised by this entity." } }, "description": "Connections between this entity and other entities." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities." } }, "description": "Risk scoring information for the entity." }, "schema_version": { "type": "string", "description": "Schema version of the entity record." }, "source": { "type": "array", "items": { "type": "string" }, "description": "Sources that produced this entity record." }, "sub_type": { "type": "string", "description": "Optional sub-type classification for the entity." }, "type": { "type": "string", "description": "The entity type." }, "url": { "type": "string", "description": "URL associated with the entity." } }, "x-found-in": "body" }, "event": { "type": "object", "properties": { "ingested": { "type": "string" } }, "x-found-in": "body" }, "labels": { "type": "object", "properties": {}, "additionalProperties": {}, "x-found-in": "body" }, "tags": { "type": "array", "items": { "type": "string" }, "x-found-in": "body" }, "user": { "type": "object", "properties": { "domain": { "type": "array", "items": { "type": "string" }, "description": "Observed user domains." }, "email": { "type": "array", "items": { "type": "string" }, "description": "Observed email addresses." }, "full_name": { "type": "array", "items": { "type": "string" }, "description": "Observed full names of the user." }, "hash": { "type": "array", "items": { "type": "string" }, "description": "Observed user hashes." }, "id": { "type": "array", "items": { "type": "string" }, "description": "Observed user identifiers." }, "name": { "type": "string", "description": "Primary user name." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score." } } }, "roles": { "type": "array", "items": { "type": "string" }, "description": "Observed roles assigned to the user." } }, "description": "Elastic Common Schema (ECS) user fields collected on the entity.", "x-found-in": "body" }, "host": { "type": "object", "properties": { "architecture": { "type": "array", "items": { "type": "string" }, "description": "Observed CPU architectures." }, "domain": { "type": "array", "items": { "type": "string" }, "description": "Observed host domains." }, "hostname": { "type": "array", "items": { "type": "string" }, "description": "Observed hostnames." }, "id": { "type": "array", "items": { "type": "string" }, "description": "Observed host identifiers." }, "ip": { "type": "array", "items": { "type": "string" }, "description": "Observed IP addresses." }, "mac": { "type": "array", "items": { "type": "string" }, "description": "Observed MAC addresses." }, "name": { "type": "string", "description": "Primary host name." }, "os": { "type": "object", "properties": { "family": { "type": "string" }, "full": { "type": "string" }, "kernel": { "type": "string" }, "name": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "platform": { "type": "string" }, "type": { "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }] }, "version": { "type": "string" } }, "description": "Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2)." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score." } } }, "type": { "type": "array", "items": { "type": "string" }, "description": "Observed host types." } }, "description": "Elastic Common Schema (ECS) host fields collected on the entity.", "x-found-in": "body" }, "service": { "type": "object", "properties": { "address": { "type": "string", "description": "Service address." }, "environment": { "type": "string", "description": "Service environment (for example, production, staging)." }, "ephemeral_id": { "type": "string", "description": "Ephemeral identifier of the service." }, "id": { "type": "string", "description": "Unique identifier of the service." }, "name": { "type": "string", "description": "Primary service name." }, "node": { "type": "object", "properties": { "name": { "type": "string", "description": "Node name." }, "role": { "type": "string", "description": "Node role." }, "roles": { "type": "array", "items": { "type": "string" }, "description": "Node roles." } }, "description": "Node information for the service." }, "risk": { "type": "object", "properties": { "calculated_level": { "enum": ["Unknown", "Low", "Moderate", "High", "Critical"], "description": "Lexical description of the entity's risk." }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score." }, "calculated_score_norm": { "type": "number", "description": "The normalized numeric value of the given entity's risk score." } } }, "state": { "type": "string", "description": "Current state of the service." }, "type": { "type": "string", "description": "Service type." }, "version": { "type": "string", "description": "Service version." } }, "description": "Elastic Common Schema (ECS) service fields collected on the entity.", "x-found-in": "body" }, "cloud": { "type": "object", "properties": { "account": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "availability_zone": { "type": "string" }, "instance": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "machine": { "type": "object", "properties": { "type": { "type": "string" } } }, "project": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "provider": { "type": "string" }, "region": { "type": "string" }, "service": { "type": "object", "properties": { "name": { "type": "string" } } } }, "description": "Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.", "x-found-in": "body" }, "orchestrator": { "type": "object", "properties": { "api_version": { "type": "string" }, "cluster": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "url": { "type": "string" }, "version": { "type": "string" } } }, "namespace": { "type": "string" }, "organization": { "type": "string" }, "resource": { "type": "object", "properties": { "annotation": { "type": "string" }, "id": { "type": "string" }, "ip": { "type": "string" }, "label": { "type": "string" }, "name": { "type": "string" }, "parent": { "type": "object", "properties": { "type": { "type": "string" } } }, "type": { "type": "string" } } }, "type": { "type": "string" } }, "description": "Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.", "x-found-in": "body" } }, "required": ["entityType"] }

package/lib/kibana/json/security-entity-store.put-security-entity-store.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "put-security-entity-store", "x-api": { "id": "security-entity-store.put-security-entity-store", "name": "put-security-entity-store", "namespace": "security-entity-store" }, "x-method": "PUT", "x-path": "/api/security/entity_store", "x-destructive": true, "type": "object", "properties": { "logExtraction": { "type": "object", "properties": { "additionalIndexPatterns": { "type": "array", "items": { "type": "string" } }, "delay": { "type": "string" }, "docsLimit": { "type": "number" }, "excludedIndexPatterns": { "type": "array", "items": { "type": "string" } }, "fieldHistoryLength": { "type": "number" }, "frequency": { "type": "string" }, "lookbackPeriod": { "type": "string" }, "maxLogsPerPage": { "type": "number" }, "maxLogsPerWindow": { "type": "number" }, "maxLogsPerWindowCapBehavior": { "enum": ["defer", "drop"] }, "maxTimeWindowSize": { "type": "string" } }, "x-found-in": "body" } }, "required": ["logExtraction"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "put-security-entity-store", "x-api": { "id": "security-entity-store.put-security-entity-store", "name": "put-security-entity-store", "namespace": "security-entity-store" }, "x-method": "PUT", "x-path": "/api/security/entity_store", "x-destructive": true, "type": "object", "properties": { "logExtraction": { "type": "object", "properties": { "additionalIndexPatterns": { "oneOf": [{ "type": "array", "items": { "type": "string" } }, { "type": "null" }] }, "delay": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "docsLimit": { "oneOf": [{ "type": "number" }, { "type": "null" }] }, "excludedIndexPatterns": { "oneOf": [{ "type": "array", "items": { "type": "string" } }, { "type": "null" }] }, "fieldHistoryLength": { "oneOf": [{ "type": "number" }, { "type": "null" }] }, "frequency": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "lookbackPeriod": { "oneOf": [{ "type": "string" }, { "type": "null" }] }, "maxLogsPerPage": { "oneOf": [{ "type": "number" }, { "type": "null" }] }, "maxLogsPerWindow": { "oneOf": [{ "type": "number" }, { "type": "null" }] }, "maxLogsPerWindowCapBehavior": { "enum": ["defer", "drop", null] }, "maxTimeWindowSize": { "oneOf": [{ "type": "string" }, { "type": "null" }] } }, "x-found-in": "body" } }, "required": ["logExtraction"] }

package/lib/kibana/json/visualizations.create-visualization.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "create-visualization", "x-api": { "id": "visualizations.create-visualization", "name": "create-visualization", "namespace": "visualizations" }, "x-method": "POST", "x-path": "/api/visualizations", "x-destructive": true, "type": "object", "properties": { "body": { "~~type~~": "~~object~~", "x-found-in": "body", "x-body-root": true } } }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "create-visualization", "x-api": { "id": "visualizations.create-visualization", "name": "create-visualization", "namespace": "visualizations" }, "x-method": "POST", "x-path": "/api/visualizations", "x-destructive": true, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "body": { "$ref": "./_defs.json#/$defs/Kibana_Dashboards_API_lensApiConfigNoESQL", "x-found-in": "body", "x-body-root": true } } }

package/lib/kibana/json/visualizations.delete-visualization.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "delete-visualization", "x-api": { "id": "visualizations.delete-visualization", "name": "delete-visualization", "namespace": "visualizations" }, "x-method": "DELETE", "x-path": "/api/visualizations/{id}", "x-destructive": true, "type": "object", "properties": { "id": { "type": "string", "description": "The id ~~parameter~~", "x-found-in": "path" } }, "required": ["id"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "delete-visualization", "x-api": { "id": "visualizations.delete-visualization", "name": "delete-visualization", "namespace": "visualizations" }, "x-method": "DELETE", "x-path": "/api/visualizations/{id}", "x-destructive": true, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "id": { "type": "string", "description": "The visualization identifier, as returned by the create or search endpoints.", "x-found-in": "path" } }, "required": ["id"] }

package/lib/kibana/json/visualizations.get-visualization.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-visualization", "x-api": { "id": "visualizations.get-visualization", "name": "get-visualization", "namespace": "visualizations" }, "x-method": "GET", "x-path": "/api/visualizations/{id}", "x-destructive": false, "type": "object", "properties": { "id": { "type": "string", "description": "The id ~~parameter~~", "x-found-in": "path" } }, "required": ["id"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-visualization", "x-api": { "id": "visualizations.get-visualization", "name": "get-visualization", "namespace": "visualizations" }, "x-method": "GET", "x-path": "/api/visualizations/{id}", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "id": { "type": "string", "description": "The visualization identifier, as returned by the create or search endpoints.", "x-found-in": "path" } }, "required": ["id"] }

package/lib/kibana/json/visualizations.search-visualizations.request.json ADDED Viewed

@@ -0,0 +1 @@

+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "search-visualizations", "x-api": { "id": "visualizations.search-visualizations", "name": "search-visualizations", "namespace": "visualizations" }, "x-method": "GET", "x-path": "/api/visualizations", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "fields": { "type": "array", "items": { "type": "string" }, "description": "The saved object fields to include in each result. When omitted, all fields are returned.", "x-found-in": "query" }, "search_fields": { "type": "array", "items": { "type": "string" }, "description": "The fields to match the `query` text against. Defaults to `title` when omitted.", "x-found-in": "query" }, "query": { "type": "string", "description": "Text to match against `search_fields`.", "x-found-in": "query" }, "page": { "type": "number", "description": "The page of results to return.", "x-found-in": "query" }, "per_page": { "type": "number", "description": "The number of results to return per page.", "x-found-in": "query" } } }

package/lib/kibana/json/visualizations.upsert-visualization.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "upsert-visualization", "x-api": { "id": "visualizations.upsert-visualization", "name": "upsert-visualization", "namespace": "visualizations" }, "x-method": "PUT", "x-path": "/api/visualizations/{id}", "x-destructive": true, "type": "object", "properties": { "id": { "type": "string", "description": "The id ~~parameter~~", "x-found-in": "path" }, "body": { "~~type~~": "~~object~~", "x-found-in": "body", "x-body-root": true } }, "required": ["id"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "upsert-visualization", "x-api": { "id": "visualizations.upsert-visualization", "name": "upsert-visualization", "namespace": "visualizations" }, "x-method": "PUT", "x-path": "/api/visualizations/{id}", "x-destructive": true, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "id": { "type": "string", "description": "The visualization identifier, as returned by the create or search endpoints.", "x-found-in": "path" }, "body": { "$ref": "./_defs.json#/$defs/Kibana_Dashboards_API_lensApiConfigNoESQL", "x-found-in": "body", "x-body-root": true } }, "required": ["id"] }

package/lib/kibana/json/workflows.get-workflows-executions-executionid-steps.request.json ADDED Viewed

@@ -0,0 +1 @@

+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-workflows-executions-executionid-steps", "x-api": { "id": "workflows.get-workflows-executions-executionid-steps", "name": "get-workflows-executions-executionid-steps", "namespace": "workflows" }, "x-method": "GET", "x-path": "/api/workflows/executions/{executionId}/steps", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "executionId": { "type": "string", "description": "Workflow execution ID", "x-found-in": "path" }, "page": { "type": "number", "description": "Page number.", "x-found-in": "query" }, "size": { "type": "number", "description": "Number of step executions per page.", "x-found-in": "query" } }, "required": ["executionId"] }

package/lib/kibana/json/workflows.get-workflows-executions-executionid.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-workflows-executions-executionid", "x-api": { "id": "workflows.get-workflows-executions-executionid", "name": "get-workflows-executions-executionid", "namespace": "workflows" }, "x-method": "GET", "x-path": "/api/workflows/executions/{executionId}", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "executionId": { "type": "string", "description": "Workflow execution ID", "x-found-in": "path" }, "includeInput": { "type": "boolean", "description": "Include execution input data.", "x-found-in": "query" }, "includeOutput": { "type": "boolean", "description": "Include execution output data.", "x-found-in": "query" } }, "required": ["executionId"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-workflows-executions-executionid", "x-api": { "id": "workflows.get-workflows-executions-executionid", "name": "get-workflows-executions-executionid", "namespace": "workflows" }, "x-method": "GET", "x-path": "/api/workflows/executions/{executionId}", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "executionId": { "type": "string", "description": "Workflow execution ID", "x-found-in": "path" }, "includeInput": { "type": "boolean", "description": "Include execution input data.", "x-found-in": "query" }, "includeOutput": { "type": "boolean", "description": "Include execution output data.", "x-found-in": "query" }, "omitStepExecutions": { "type": "boolean", "description": "When `true`, omit the embedded `stepExecutions` array. Defaults to `false`. When this is `false`, the embed is capped at 5000 steps.", "x-found-in": "query" } }, "required": ["executionId"] }

package/lib/kibana/json/workflows.get-workflows-workflow-workflowid-executions.request.json CHANGED Viewed

	@@ -1 +1 @@
1	- { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-workflows-workflow-workflowid-executions", "x-api": { "id": "workflows.get-workflows-workflow-workflowid-executions", "name": "get-workflows-workflow-workflowid-executions", "namespace": "workflows" }, "x-method": "GET", "x-path": "/api/workflows/workflow/{workflowId}/executions", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "workflowId": { "type": "string", "description": "Workflow ID", "x-found-in": "path" }, "statuses": { "type": "array", "items": { "enum": ["pending", "waiting", "waiting_for_input", "waiting_for_child", "running", "queued", "completed", "failed", "cancelled", "timed_out", "skipped"] }, "description": "Filter by execution status.", "x-found-in": "query" }, "executionTypes": { "type": "array", "items": { "enum": ["test", "production"] }, "description": "Filter by execution type.", "x-found-in": "query" }, "executedBy": { "type": "array", "items": { "type": "string" }, "description": "Filter by the user who triggered the execution.", "x-found-in": "query" }, "concurrencyGroupKey": { "type": "string", "description": "Filter by evaluated concurrency group key.", "x-found-in": "query" }, "omitStepRuns": { "type": "boolean", "description": "Whether to exclude step-level execution data.", "x-found-in": "query" }, "finishedAfter": { "type": "string", "description": "Datemath lower bound for filtering executions by finishedAt (inclusive when parsed).", "x-found-in": "query" }, "finishedBefore": { "type": "string", "description": "Datemath upper bound for filtering executions by finishedAt (inclusive when parsed with roundUp).", "x-found-in": "query" }, "collapse": { "enum": ["concurrencyGroupKey", "status", "executedBy", "triggeredBy"], "description": "Field to collapse execution results by.", "x-found-in": "query" }, "sortField": { "enum": ["createdAt", "finishedAt"], "description": "Field to sort executions by.", "x-found-in": "query" }, "sortOrder": { "enum": ["asc", "desc"], "description": "Sort order.", "x-found-in": "query" }, "page": { "type": "number", "description": "Page number.", "x-found-in": "query" }, "size": { "type": "number", "description": "Number of results per page.", "x-found-in": "query" }, "startedAfter": { "type": "string", "description": "Datemath lower bound for filtering executions by startedAt (inclusive when parsed).", "x-found-in": "query" }, "startedBefore": { "type": "string", "description": "Datemath upper bound for filtering executions by startedAt (inclusive when parsed with roundUp).", "x-found-in": "query" } }, "required": ["workflowId"] }
1	+ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "get-workflows-workflow-workflowid-executions", "x-api": { "id": "workflows.get-workflows-workflow-workflowid-executions", "name": "get-workflows-workflow-workflowid-executions", "namespace": "workflows" }, "x-method": "GET", "x-path": "/api/workflows/workflow/{workflowId}/executions", "x-destructive": false, "x-availability": { "serverless": { "stability": "stable" } }, "type": "object", "properties": { "workflowId": { "type": "string", "description": "Workflow ID", "x-found-in": "path" }, "statuses": { "type": "array", "items": { "enum": ["pending", "waiting", "waiting_for_input", "waiting_for_child", "running", "queued", "completed", "failed", "cancelled", "timed_out", "skipped"] }, "description": "Filter by execution status.", "x-found-in": "query" }, "executionTypes": { "type": "array", "items": { "enum": ["test", "production"] }, "description": "Filter by execution type.", "x-found-in": "query" }, "executedBy": { "type": "array", "items": { "type": "string" }, "description": "Filter by the user who triggered the execution.", "x-found-in": "query" }, "concurrencyGroupKey": { "type": "string", "description": "Filter by evaluated concurrency group key.", "x-found-in": "query" }, "omitStepRuns": { "type": "boolean", "description": "Whether to exclude step-level execution data.", "x-found-in": "query" }, "finishedAfter": { "type": "string", "description": "Datemath lower bound for filtering executions by finishedAt (inclusive when parsed).", "x-found-in": "query" }, "finishedBefore": { "type": "string", "description": "Datemath upper bound for filtering executions by finishedAt (inclusive when parsed with roundUp).", "x-found-in": "query" }, "collapse": { "enum": ["concurrencyGroupKey", "status", "executedBy", "triggeredBy"], "description": "Field to collapse execution results by.", "x-found-in": "query" }, "sortField": { "enum": ["createdAt", "finishedAt"], "description": "Field to sort executions by.", "x-found-in": "query" }, "sortOrder": { "enum": ["asc", "desc"], "description": "Sort order.", "x-found-in": "query" }, "page": { "type": "number", "description": "Page number.", "x-found-in": "query" }, "size": { "type": "number", "description": "Number of results per page.", "x-found-in": "query" }, "searchAfter": { "type": "string", "description": "JSON-encoded search_after sort values from a prior response for cursor pagination.", "x-found-in": "query" }, "startedAfter": { "type": "string", "description": "Datemath lower bound for filtering executions by startedAt (inclusive when parsed).", "x-found-in": "query" }, "startedBefore": { "type": "string", "description": "Datemath upper bound for filtering executions by startedAt (inclusive when parsed with roundUp).", "x-found-in": "query" } }, "required": ["workflowId"] }