@elastic/schemas 0.7.3 → 0.7.4

package/src/kibana/json/fleet-cloud-connectors.post-fleet-cloud-connectors.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-cloud-connectors","x-api":{"id":"fleet-cloud-connectors.post-fleet-cloud-connectors","name":"post-fleet-cloud-connectors","namespace":"fleet-cloud-connectors"},"x-method":"POST","x-path":"/api/fleet/cloud_connectors","x-destructive":false,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"accountType":{"enum":["single-account","organization-account"],"description":"The account type: single-account (single account/subscription) or organization-account (organization-wide).","x-found-in":"body"},"cloudProvider":{"enum":["aws","azure","gcp"],"description":"The cloud provider type: aws, azure, or gcp.","x-found-in":"body"},"name":{"type":"string","description":"The name of the cloud connector.","x-found-in":"body"},"vars":{"type":"object","additionalProperties":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"object","properties":{"frozen":{"type":"boolean"},"type":{"type":"string"},"value":{"oneOf":[{"type":"string"},{"type":"object","properties":{"id":{"type":"string"},"isSecretRef":{"type":"boolean"}},"required":["isSecretRef","id"]}]}},"required":["type","value"]}]},"x-found-in":"body"}},"required":["name","cloudProvider","vars"]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-cloud-connectors","x-api":{"id":"fleet-cloud-connectors.post-fleet-cloud-connectors","name":"post-fleet-cloud-connectors","namespace":"fleet-cloud-connectors"},"x-method":"POST","x-path":"/api/fleet/cloud_connectors","x-destructive":false,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"accountType":{"enum":["single-account","organization-account"],"description":"The account type: single-account (single account/subscription) or organization-account (organization-wide).","x-found-in":"body"},"cloudProvider":{"enum":["aws","azure","gcp"],"description":"The cloud provider type: aws, azure, or gcp.","x-found-in":"body"},"iac_blueprint_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Identifier of the template source last used for this connector. Set to null to remove it.","x-found-in":"body"},"iac_blueprint_version":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Version of the template source last used for this connector. Set to null to remove it.","x-found-in":"body"},"iac_deployment_id":{"type":"string","description":"Identifier of the last CloudFormation stack deployed for this connector.","x-found-in":"body"},"iac_key":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.","x-found-in":"body"},"name":{"type":"string","description":"The name of the cloud connector.","x-found-in":"body"},"vars":{"type":"object","additionalProperties":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"object","properties":{"frozen":{"type":"boolean"},"type":{"type":"string"},"value":{"oneOf":[{"type":"string"},{"type":"object","properties":{"id":{"type":"string"},"isSecretRef":{"type":"boolean"}},"required":["isSecretRef","id"]}]}},"required":["type","value"]}]},"x-found-in":"body"}},"required":["name","cloudProvider","vars"]}

package/src/kibana/json/fleet-cloud-connectors.post-fleet-cloud-connectors.response.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-cloud-connectors","x-api":{"id":"fleet-cloud-connectors.post-fleet-cloud-connectors","name":"post-fleet-cloud-connectors","namespace":"fleet-cloud-connectors"},"type":"object","properties":{"item":{"type":"object","properties":{"accountType":{"type":"string"},"cloudProvider":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"namespace":{"type":"string"},"packagePolicyCount":{"type":"number"},"updated_at":{"type":"string"},"vars":{"type":"object","additionalProperties":{}},"verification_failed_at":{"type":"string"},"verification_started_at":{"type":"string"},"verification_status":{"type":"string"}},"required":["id","name","cloudProvider","vars","packagePolicyCount","created_at","updated_at"]}},"required":["item"]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-cloud-connectors","x-api":{"id":"fleet-cloud-connectors.post-fleet-cloud-connectors","name":"post-fleet-cloud-connectors","namespace":"fleet-cloud-connectors"},"type":"object","properties":{"item":{"type":"object","properties":{"accountType":{"type":"string"},"cloudProvider":{"type":"string"},"created_at":{"type":"string"},"iac_blueprint_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Identifier of the template source last used for this connector. Set to null to remove it."},"iac_blueprint_version":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Version of the template source last used for this connector. Set to null to remove it."},"iac_deployment_id":{"type":"string","description":"Identifier of the last CloudFormation stack deployed for this connector."},"iac_key":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Checksum of the CloudFormation template last saved on this connector. Set to null to remove it."},"iac_upgrade_checked_at":{"type":"string","description":"When this connector was last checked for a CloudFormation template upgrade."},"iac_upgrade_status":{"enum":["up_to_date","upgrade_available"],"description":"Whether a newer CloudFormation template is available for this connector."},"id":{"type":"string"},"name":{"type":"string"},"namespace":{"type":"string"},"packagePolicyCount":{"type":"number"},"updated_at":{"type":"string"},"vars":{"type":"object","additionalProperties":{}},"verification_failed_at":{"type":"string"},"verification_started_at":{"type":"string"},"verification_status":{"type":"string"}},"required":["id","name","cloudProvider","vars","packagePolicyCount","created_at","updated_at"]}},"required":["item"]}

package/src/kibana/json/fleet-cloud-connectors.put-fleet-cloud-connectors-cloudconnectorid.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-fleet-cloud-connectors-cloudconnectorid","x-api":{"id":"fleet-cloud-connectors.put-fleet-cloud-connectors-cloudconnectorid","name":"put-fleet-cloud-connectors-cloudconnectorid","namespace":"fleet-cloud-connectors"},"x-method":"PUT","x-path":"/api/fleet/cloud_connectors/{cloudConnectorId}","x-destructive":true,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"cloudConnectorId":{"type":"string","description":"The unique identifier of the cloud connector to update.","x-found-in":"path"},"accountType":{"enum":["single-account","organization-account"],"description":"The account type: single-account (single account/subscription) or organization-account (organization-wide).","x-found-in":"body"},"name":{"type":"string","description":"The name of the cloud connector.","x-found-in":"body"},"vars":{"type":"object","additionalProperties":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"object","properties":{"frozen":{"type":"boolean"},"type":{"type":"string"},"value":{"oneOf":[{"type":"string"},{"type":"object","properties":{"id":{"type":"string"},"isSecretRef":{"type":"boolean"}},"required":["isSecretRef","id"]}]}},"required":["type","value"]}]},"x-found-in":"body"}},"required":["cloudConnectorId"]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-fleet-cloud-connectors-cloudconnectorid","x-api":{"id":"fleet-cloud-connectors.put-fleet-cloud-connectors-cloudconnectorid","name":"put-fleet-cloud-connectors-cloudconnectorid","namespace":"fleet-cloud-connectors"},"x-method":"PUT","x-path":"/api/fleet/cloud_connectors/{cloudConnectorId}","x-destructive":true,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"cloudConnectorId":{"type":"string","description":"The unique identifier of the cloud connector to update.","x-found-in":"path"},"accountType":{"enum":["single-account","organization-account"],"description":"The account type: single-account (single account/subscription) or organization-account (organization-wide).","x-found-in":"body"},"iac_blueprint_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Identifier of the template source last used for this connector. Set to null to remove it.","x-found-in":"body"},"iac_blueprint_version":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Version of the template source last used for this connector. Set to null to remove it.","x-found-in":"body"},"iac_deployment_id":{"type":"string","description":"Identifier of the last CloudFormation stack deployed for this connector.","x-found-in":"body"},"iac_key":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.","x-found-in":"body"},"name":{"type":"string","description":"The name of the cloud connector.","x-found-in":"body"},"vars":{"type":"object","additionalProperties":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"object","properties":{"frozen":{"type":"boolean"},"type":{"type":"string"},"value":{"oneOf":[{"type":"string"},{"type":"object","properties":{"id":{"type":"string"},"isSecretRef":{"type":"boolean"}},"required":["isSecretRef","id"]}]}},"required":["type","value"]}]},"x-found-in":"body"}},"required":["cloudConnectorId"]}

package/src/kibana/json/fleet-cloud-connectors.put-fleet-cloud-connectors-cloudconnectorid.response.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-fleet-cloud-connectors-cloudconnectorid","x-api":{"id":"fleet-cloud-connectors.put-fleet-cloud-connectors-cloudconnectorid","name":"put-fleet-cloud-connectors-cloudconnectorid","namespace":"fleet-cloud-connectors"},"type":"object","properties":{"item":{"type":"object","properties":{"accountType":{"type":"string"},"cloudProvider":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"namespace":{"type":"string"},"packagePolicyCount":{"type":"number"},"updated_at":{"type":"string"},"vars":{"type":"object","additionalProperties":{}},"verification_failed_at":{"type":"string"},"verification_started_at":{"type":"string"},"verification_status":{"type":"string"}},"required":["id","name","cloudProvider","vars","packagePolicyCount","created_at","updated_at"]}},"required":["item"]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-fleet-cloud-connectors-cloudconnectorid","x-api":{"id":"fleet-cloud-connectors.put-fleet-cloud-connectors-cloudconnectorid","name":"put-fleet-cloud-connectors-cloudconnectorid","namespace":"fleet-cloud-connectors"},"type":"object","properties":{"item":{"type":"object","properties":{"accountType":{"type":"string"},"cloudProvider":{"type":"string"},"created_at":{"type":"string"},"iac_blueprint_id":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Identifier of the template source last used for this connector. Set to null to remove it."},"iac_blueprint_version":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Version of the template source last used for this connector. Set to null to remove it."},"iac_deployment_id":{"type":"string","description":"Identifier of the last CloudFormation stack deployed for this connector."},"iac_key":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Checksum of the CloudFormation template last saved on this connector. Set to null to remove it."},"iac_upgrade_checked_at":{"type":"string","description":"When this connector was last checked for a CloudFormation template upgrade."},"iac_upgrade_status":{"enum":["up_to_date","upgrade_available"],"description":"Whether a newer CloudFormation template is available for this connector."},"id":{"type":"string"},"name":{"type":"string"},"namespace":{"type":"string"},"packagePolicyCount":{"type":"number"},"updated_at":{"type":"string"},"vars":{"type":"object","additionalProperties":{}},"verification_failed_at":{"type":"string"},"verification_started_at":{"type":"string"},"verification_status":{"type":"string"}},"required":["id","name","cloudProvider","vars","packagePolicyCount","created_at","updated_at"]}},"required":["item"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.delete-fleet-cloud-onboarding-deployments-id.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"delete-fleet-cloud-onboarding-deployments-id","x-api":{"id":"fleet-cloud-onboarding-deployments.delete-fleet-cloud-onboarding-deployments-id","name":"delete-fleet-cloud-onboarding-deployments-id","namespace":"fleet-cloud-onboarding-deployments"},"x-method":"DELETE","x-path":"/api/fleet/cloud_onboarding_deployments/{id}","x-destructive":true,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"id":{"type":"string","description":"The saved object ID of the cloud onboarding deployment.","x-found-in":"path"}},"required":["id"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.delete-fleet-cloud-onboarding-deployments-id.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"delete-fleet-cloud-onboarding-deployments-id","x-api":{"id":"fleet-cloud-onboarding-deployments.delete-fleet-cloud-onboarding-deployments-id","name":"delete-fleet-cloud-onboarding-deployments-id","namespace":"fleet-cloud-onboarding-deployments"},"type":"object","properties":{"id":{"type":"string"}},"required":["id"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-connector-connectorid.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-cloud-onboarding-deployments-connector-connectorid","x-api":{"id":"fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-connector-connectorid","name":"get-fleet-cloud-onboarding-deployments-connector-connectorid","namespace":"fleet-cloud-onboarding-deployments"},"x-method":"GET","x-path":"/api/fleet/cloud_onboarding_deployments/connector/{connectorId}","x-destructive":false,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"connectorId":{"type":"string","description":"The fleet-cloud-connector ID to list deployments for.","x-found-in":"path"}},"required":["connectorId"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-connector-connectorid.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-cloud-onboarding-deployments-connector-connectorid","x-api":{"id":"fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-connector-connectorid","name":"get-fleet-cloud-onboarding-deployments-connector-connectorid","namespace":"fleet-cloud-onboarding-deployments"},"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"agentPolicyId":{"type":"string","description":"Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms."},"apiKeyId":{"type":"string","description":"Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation."},"attemptCount":{"type":"number","description":"Number of deployment attempts, including the current one."},"authMethod":{"enum":["identity_federation","static_keys"],"description":"Authentication method for managed integrations."},"connectorId":{"type":"string","description":"ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments."},"dataFormat":{"enum":["ecs","otel"],"description":"Data format: ecs or otel."},"deploymentId":{"type":"string","description":"Opaque deployment identifier; for AWS, the CFN stack ARN."},"deploymentName":{"type":"string","description":"Opaque deployment name; for AWS, the CFN stack name."},"ecfStacks":{"type":"array","items":{"type":"object","properties":{"family":{"enum":["unified","otel","crowdstrike"],"description":"ECF template family."},"stackName":{"type":"string","description":"CloudFormation stack name (128-char AWS limit)."},"templateVersion":{"type":"string","description":"ECF semantic version resolved at launch time, e.g. \"1.10.0\"."}},"required":["family","stackName","templateVersion"]},"description":"ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch."},"globalRegion":{"type":"string","description":"Global AWS region from the Service Settings step."},"id":{"type":"string"},"mechanisms":{"type":"array","items":{"enum":["managed_integration","ecf","agent_based"]}},"packagePolicyIds":{"type":"array","items":{"type":"string"},"description":"Package policy IDs created for managed_integration services."},"provider":{"enum":["aws","azure","gcp"],"description":"Cloud provider."},"services":{"type":"array","items":{"type":"string"},"description":"Service IDs covered by this deployment."},"serviceVars":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}},"description":"Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step."},"status":{"enum":["pending","deploying","succeeded","failed"],"description":"Deployment status."},"statusMessage":{"type":"string","description":"Error context when status is failed."}},"required":["id","provider","mechanisms","services","status","attemptCount"]}}},"required":["items"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-id.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-cloud-onboarding-deployments-id","x-api":{"id":"fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-id","name":"get-fleet-cloud-onboarding-deployments-id","namespace":"fleet-cloud-onboarding-deployments"},"x-method":"GET","x-path":"/api/fleet/cloud_onboarding_deployments/{id}","x-destructive":false,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"id":{"type":"string","description":"The saved object ID of the cloud onboarding deployment.","x-found-in":"path"}},"required":["id"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-id.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-cloud-onboarding-deployments-id","x-api":{"id":"fleet-cloud-onboarding-deployments.get-fleet-cloud-onboarding-deployments-id","name":"get-fleet-cloud-onboarding-deployments-id","namespace":"fleet-cloud-onboarding-deployments"},"type":"object","properties":{"item":{"type":"object","properties":{"agentPolicyId":{"type":"string","description":"Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms."},"apiKeyId":{"type":"string","description":"Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation."},"attemptCount":{"type":"number","description":"Number of deployment attempts, including the current one."},"authMethod":{"enum":["identity_federation","static_keys"],"description":"Authentication method for managed integrations."},"connectorId":{"type":"string","description":"ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments."},"dataFormat":{"enum":["ecs","otel"],"description":"Data format: ecs or otel."},"deploymentId":{"type":"string","description":"Opaque deployment identifier; for AWS, the CFN stack ARN."},"deploymentName":{"type":"string","description":"Opaque deployment name; for AWS, the CFN stack name."},"ecfStacks":{"type":"array","items":{"type":"object","properties":{"family":{"enum":["unified","otel","crowdstrike"],"description":"ECF template family."},"stackName":{"type":"string","description":"CloudFormation stack name (128-char AWS limit)."},"templateVersion":{"type":"string","description":"ECF semantic version resolved at launch time, e.g. \"1.10.0\"."}},"required":["family","stackName","templateVersion"]},"description":"ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch."},"globalRegion":{"type":"string","description":"Global AWS region from the Service Settings step."},"id":{"type":"string"},"mechanisms":{"type":"array","items":{"enum":["managed_integration","ecf","agent_based"]}},"packagePolicyIds":{"type":"array","items":{"type":"string"},"description":"Package policy IDs created for managed_integration services."},"provider":{"enum":["aws","azure","gcp"],"description":"Cloud provider."},"services":{"type":"array","items":{"type":"string"},"description":"Service IDs covered by this deployment."},"serviceVars":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}},"description":"Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step."},"status":{"enum":["pending","deploying","succeeded","failed"],"description":"Deployment status."},"statusMessage":{"type":"string","description":"Error context when status is failed."}},"required":["id","provider","mechanisms","services","status","attemptCount"]}},"required":["item"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.post-fleet-cloud-onboarding-deployments.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-cloud-onboarding-deployments","x-api":{"id":"fleet-cloud-onboarding-deployments.post-fleet-cloud-onboarding-deployments","name":"post-fleet-cloud-onboarding-deployments","namespace":"fleet-cloud-onboarding-deployments"},"x-method":"POST","x-path":"/api/fleet/cloud_onboarding_deployments","x-destructive":true,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"authMethod":{"enum":["identity_federation","static_keys"],"description":"Authentication method for managed integrations.","x-found-in":"body"},"connectorId":{"type":"string","description":"ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.","x-found-in":"body"},"dataFormat":{"enum":["ecs","otel"],"description":"Data format: ecs or otel.","x-found-in":"body"},"globalRegion":{"type":"string","description":"Global AWS region from the Service Settings step.","x-found-in":"body"},"mechanisms":{"type":"array","items":{"enum":["managed_integration","ecf","agent_based"]},"description":"Delivery mechanisms active in this deployment.","x-found-in":"body"},"provider":{"enum":["aws","azure","gcp"],"description":"Cloud provider.","x-found-in":"body"},"services":{"type":"array","items":{"type":"string"},"description":"Service IDs to be covered by this deployment.","x-found-in":"body"},"serviceVars":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}},"description":"Per-service config keyed by instance ID.","x-found-in":"body"}},"required":["provider","mechanisms","services"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.post-fleet-cloud-onboarding-deployments.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-fleet-cloud-onboarding-deployments","x-api":{"id":"fleet-cloud-onboarding-deployments.post-fleet-cloud-onboarding-deployments","name":"post-fleet-cloud-onboarding-deployments","namespace":"fleet-cloud-onboarding-deployments"},"type":"object","properties":{"item":{"type":"object","properties":{"agentPolicyId":{"type":"string","description":"Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms."},"apiKeyId":{"type":"string","description":"Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation."},"attemptCount":{"type":"number","description":"Number of deployment attempts, including the current one."},"authMethod":{"enum":["identity_federation","static_keys"],"description":"Authentication method for managed integrations."},"connectorId":{"type":"string","description":"ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments."},"dataFormat":{"enum":["ecs","otel"],"description":"Data format: ecs or otel."},"deploymentId":{"type":"string","description":"Opaque deployment identifier; for AWS, the CFN stack ARN."},"deploymentName":{"type":"string","description":"Opaque deployment name; for AWS, the CFN stack name."},"ecfStacks":{"type":"array","items":{"type":"object","properties":{"family":{"enum":["unified","otel","crowdstrike"],"description":"ECF template family."},"stackName":{"type":"string","description":"CloudFormation stack name (128-char AWS limit)."},"templateVersion":{"type":"string","description":"ECF semantic version resolved at launch time, e.g. \"1.10.0\"."}},"required":["family","stackName","templateVersion"]},"description":"ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch."},"globalRegion":{"type":"string","description":"Global AWS region from the Service Settings step."},"id":{"type":"string"},"mechanisms":{"type":"array","items":{"enum":["managed_integration","ecf","agent_based"]}},"packagePolicyIds":{"type":"array","items":{"type":"string"},"description":"Package policy IDs created for managed_integration services."},"provider":{"enum":["aws","azure","gcp"],"description":"Cloud provider."},"services":{"type":"array","items":{"type":"string"},"description":"Service IDs covered by this deployment."},"serviceVars":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}},"description":"Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step."},"status":{"enum":["pending","deploying","succeeded","failed"],"description":"Deployment status."},"statusMessage":{"type":"string","description":"Error context when status is failed."}},"required":["id","provider","mechanisms","services","status","attemptCount"]}},"required":["item"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.put-fleet-cloud-onboarding-deployments-id.request.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-fleet-cloud-onboarding-deployments-id","x-api":{"id":"fleet-cloud-onboarding-deployments.put-fleet-cloud-onboarding-deployments-id","name":"put-fleet-cloud-onboarding-deployments-id","namespace":"fleet-cloud-onboarding-deployments"},"x-method":"PUT","x-path":"/api/fleet/cloud_onboarding_deployments/{id}","x-destructive":true,"x-availability":{"serverless":{"stability":"experimental"}},"type":"object","properties":{"id":{"type":"string","description":"The saved object ID of the cloud onboarding deployment.","x-found-in":"path"},"agentPolicyId":{"type":"string","x-found-in":"body"},"apiKeyId":{"type":"string","x-found-in":"body"},"attemptCount":{"type":"number","description":"Incremented by callers performing a retry.","x-found-in":"body"},"deploymentId":{"type":"string","description":"CFN stack ARN (or equivalent); provided by the client after manual deployment.","x-found-in":"body"},"deploymentName":{"type":"string","x-found-in":"body"},"ecfStacks":{"type":"array","items":{"type":"object","properties":{"family":{"enum":["unified","otel","crowdstrike"],"description":"ECF template family."},"stackName":{"type":"string","description":"CloudFormation stack name (128-char AWS limit)."},"templateVersion":{"type":"string","description":"ECF semantic version resolved at launch time, e.g. \"1.10.0\"."}},"required":["family","stackName","templateVersion"]},"description":"ECF CloudFormation stacks to record for this deployment.","x-found-in":"body"},"packagePolicyIds":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"serviceVars":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}},"description":"Per-service config keyed by instance ID.","x-found-in":"body"},"status":{"enum":["pending","deploying","succeeded","failed"],"description":"Deployment status.","x-found-in":"body"},"statusMessage":{"type":"string","description":"Error context; set when transitioning to failed.","x-found-in":"body"}},"required":["id"]}

package/src/kibana/json/fleet-cloud-onboarding-deployments.put-fleet-cloud-onboarding-deployments-id.response.json

@@ -0,0 +1 @@
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"put-fleet-cloud-onboarding-deployments-id","x-api":{"id":"fleet-cloud-onboarding-deployments.put-fleet-cloud-onboarding-deployments-id","name":"put-fleet-cloud-onboarding-deployments-id","namespace":"fleet-cloud-onboarding-deployments"},"type":"object","properties":{"item":{"type":"object","properties":{"agentPolicyId":{"type":"string","description":"Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms."},"apiKeyId":{"type":"string","description":"Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation."},"attemptCount":{"type":"number","description":"Number of deployment attempts, including the current one."},"authMethod":{"enum":["identity_federation","static_keys"],"description":"Authentication method for managed integrations."},"connectorId":{"type":"string","description":"ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments."},"dataFormat":{"enum":["ecs","otel"],"description":"Data format: ecs or otel."},"deploymentId":{"type":"string","description":"Opaque deployment identifier; for AWS, the CFN stack ARN."},"deploymentName":{"type":"string","description":"Opaque deployment name; for AWS, the CFN stack name."},"ecfStacks":{"type":"array","items":{"type":"object","properties":{"family":{"enum":["unified","otel","crowdstrike"],"description":"ECF template family."},"stackName":{"type":"string","description":"CloudFormation stack name (128-char AWS limit)."},"templateVersion":{"type":"string","description":"ECF semantic version resolved at launch time, e.g. \"1.10.0\"."}},"required":["family","stackName","templateVersion"]},"description":"ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch."},"globalRegion":{"type":"string","description":"Global AWS region from the Service Settings step."},"id":{"type":"string"},"mechanisms":{"type":"array","items":{"enum":["managed_integration","ecf","agent_based"]}},"packagePolicyIds":{"type":"array","items":{"type":"string"},"description":"Package policy IDs created for managed_integration services."},"provider":{"enum":["aws","azure","gcp"],"description":"Cloud provider."},"services":{"type":"array","items":{"type":"string"},"description":"Service IDs covered by this deployment."},"serviceVars":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{}},"description":"Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step."},"status":{"enum":["pending","deploying","succeeded","failed"],"description":"Deployment status."},"statusMessage":{"type":"string","description":"Error context when status is failed."}},"required":["id","provider","mechanisms","services","status","attemptCount"]}},"required":["item"]}

package/src/kibana/json/security-detections-api.set-alerts-status.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"set-alerts-status","x-api":{"id":"security-detections-api.set-alerts-status","name":"set-alerts-status","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/signals/status","x-destructive":true,"type":"object","properties":{"reason":{"$ref":"./_defs.json#/$defs/Security_Detections_API_Reason","x-found-in":"body"},"signal_ids":{"type":"array","items":{"type":"string"},"description":"List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.","x-found-in":"body"},"status":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AlertStatusExceptClosed","x-found-in":"body"},"conflicts":{"enum":["abort","proceed"],"x-found-in":"body"},"query":{"type":"object","additionalProperties":true,"x-found-in":"body"},"runtime_fields":{"type":"object","additionalProperties":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuntimeFieldType"},"description":"Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.","x-found-in":"body"}},"required":["status"]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"set-alerts-status","x-api":{"id":"security-detections-api.set-alerts-status","name":"set-alerts-status","namespace":"security-detections-api"},"x-method":"POST","x-path":"/api/detection_engine/signals/status","x-destructive":true,"type":"object","properties":{"reason":{"$ref":"./_defs.json#/$defs/Security_Detections_API_Reason","x-found-in":"body"},"signal_ids":{"type":"array","items":{"type":"string"},"description":"List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.","x-found-in":"body"},"status":{"$ref":"./_defs.json#/$defs/Security_Detections_API_AlertStatusExceptClosed","x-found-in":"body"},"conflicts":{"enum":["abort","proceed"],"x-found-in":"body"},"query":{"type":"object","additionalProperties":true,"x-found-in":"body"},"runtime_fields":{"type":"object","additionalProperties":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuntimeFieldType"},"description":"Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.","x-found-in":"body"},"runtime_mappings":{"type":"object","additionalProperties":{"$ref":"./_defs.json#/$defs/Security_Detections_API_RuntimeFieldMapping"},"description":"Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.","x-found-in":"body"}},"required":["status"]}

package/src/kibana/json/security-entity-store.post-security-entity-store-entities-entitytype.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.post-security-entity-store-entities-entitytype","name":"post-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":false,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to create.","x-found-in":"path"},"@timestamp":{"type":"string","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string"},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null]},"environment":{"type":"string"},"id":{"type":"string"},"model":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"serial_number":{"type":"string"},"vendor":{"type":"string"}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean"},"known_redirects":{"type":"array","items":{"type":"string"}},"managed":{"type":"boolean"},"mfa_enabled":{"type":"boolean"},"oauth_consent_restriction":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"storage_class":{"type":"string"},"watchlists":{"type":"array","items":{"type":"string"}}}},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"}},"rule_names":{"type":"array","items":{"type":"string"}}}},"created_by":{"type":"string"},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string"}}},"id":{"type":"string"},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string"},"last_activity":{"type":"string"},"last_seen":{"type":"string"}}},"name":{"type":"string"},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}}}},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"schema_version":{"type":"string"},"source":{"type":"array","items":{"type":"string"}},"sub_type":{"type":"string"},"type":{"type":"string"},"url":{"type":"string"}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"}},"email":{"type":"array","items":{"type":"string"}},"full_name":{"type":"array","items":{"type":"string"}},"hash":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"roles":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"hostname":{"type":"array","items":{"type":"string"}},"id":{"type":"array","items":{"type":"string"}},"ip":{"type":"array","items":{"type":"string"}},"mac":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"type":{"type":"array","items":{"type":"string"}}},"x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string"},"environment":{"type":"string"},"ephemeral_id":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"node":{"type":"object","properties":{"name":{"type":"string"},"role":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}}}},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"]},"calculated_score":{"type":"number"},"calculated_score_norm":{"type":"number"}}},"state":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"x-found-in":"body"}},"required":["entityType"]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-entities-entitytype","x-api":{"id":"security-entity-store.post-security-entity-store-entities-entitytype","name":"post-security-entity-store-entities-entitytype","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/entities/{entityType}","x-destructive":false,"type":"object","properties":{"entityType":{"type":"string","description":"The entity type to create.","x-found-in":"path"},"@timestamp":{"type":"string","description":"The time the entity record was last updated.","x-found-in":"body"},"asset":{"type":"object","properties":{"business_unit":{"type":"string","description":"Business unit the asset belongs to."},"criticality":{"enum":["low_impact","medium_impact","high_impact","extreme_impact",null],"description":"The criticality level assigned to this asset."},"environment":{"type":"string","description":"Deployment environment (for example, production, staging)."},"id":{"type":"string","description":"Unique identifier for the asset."},"model":{"type":"string","description":"Model name or number."},"name":{"type":"string","description":"Human-readable asset name."},"owner":{"type":"string","description":"The owner of the asset."},"serial_number":{"type":"string","description":"Serial number of the asset."},"vendor":{"type":"string","description":"Vendor or manufacturer."}},"x-found-in":"body"},"entity":{"type":"object","properties":{"attributes":{"type":"object","properties":{"asset":{"type":"boolean","description":"Whether the entity is classified as an asset."},"known_redirects":{"type":"array","items":{"type":"string"},"description":"Known redirect URIs or URLs (e.g. OAuth application callbacks)."},"managed":{"type":"boolean","description":"Whether the entity is managed (for example, via a directory service)."},"mfa_enabled":{"type":"boolean","description":"Whether multi-factor authentication is enabled for the entity."},"oauth_consent_restriction":{"type":"string","description":"OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."},"permissions":{"type":"array","items":{"type":"string"},"description":"Action-level permissions granted to this entity (not roles or groups)."},"storage_class":{"type":"string","description":"Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."},"watchlists":{"type":"array","items":{"type":"string"},"description":"Watchlist identifiers the entity belongs to (v2)."}},"description":"Boolean flags describing characteristics of the entity."},"behaviors":{"type":"object","properties":{"anomaly_job_ids":{"type":"array","items":{"type":"string"},"description":"Machine learning anomaly job identifiers (v2)."},"rule_names":{"type":"array","items":{"type":"string"},"description":"Detection rule names that flagged this entity (v2)."}},"description":"Behavioral signals observed for the entity."},"created_by":{"type":"string","description":"Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."},"EngineMetadata":{"type":"object","properties":{"Type":{"type":"string","description":"The engine type that produced this entity record."}}},"id":{"type":"string","description":"Unique identifier for this entity."},"lifecycle":{"type":"object","properties":{"first_seen":{"type":"string","description":"When the entity was first observed."},"last_activity":{"type":"string","description":"When the entity last generated activity."},"last_seen":{"type":"string","description":"When the entity was last observed."}},"description":"Timestamps tracking the entity lifecycle."},"name":{"type":"string","description":"Human-readable name of the entity."},"relationships":{"type":"object","properties":{"accesses_frequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities this entity accesses frequently."},"accesses_infrequently":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities this entity accesses infrequently."},"administers":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities this entity administers (for example, a user who is an admin of a service)."},"communicates_with":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities this entity communicates with."},"depends_on":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities this entity depends on."},"owns":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities owned by this entity."},"owns_inferred":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities inferred to be owned by this entity."},"resolution":{"type":"object","properties":{"resolved_to":{"type":"string","description":"entity.id of the entity this one resolves to"},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"],"description":"Lexical description of the resolution group's aggregated risk."},"calculated_score":{"type":"number","description":"The raw numeric value of the resolution group's aggregated risk score."},"calculated_score_norm":{"type":"number","description":"The normalized numeric value of the resolution group's aggregated risk score."}},"description":"Aggregated risk score for the resolution group."}},"description":"Resolution metadata linking this entity to another."},"supervises":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."},"raw_identifiers":{"type":"object","properties":{"entity.id":{"type":"array","items":{"type":"string"}},"host.id":{"type":"array","items":{"type":"string"}},"host.name":{"type":"array","items":{"type":"string"}},"service.name":{"type":"array","items":{"type":"string"}},"user.email":{"type":"array","items":{"type":"string"}},"user.id":{"type":"array","items":{"type":"string"}},"user.name":{"type":"array","items":{"type":"string"}}}}},"description":"Entities supervised by this entity."}},"description":"Connections between this entity and other entities."},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"],"description":"Lexical description of the entity's risk."},"calculated_score":{"type":"number","description":"The raw numeric value of the given entity's risk score."},"calculated_score_norm":{"type":"number","description":"The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."}},"description":"Risk scoring information for the entity."},"schema_version":{"type":"string","description":"Schema version of the entity record."},"source":{"type":"array","items":{"type":"string"},"description":"Sources that produced this entity record."},"sub_type":{"type":"string","description":"Optional sub-type classification for the entity."},"type":{"type":"string","description":"The entity type."},"url":{"type":"string","description":"URL associated with the entity."}},"x-found-in":"body"},"event":{"type":"object","properties":{"ingested":{"type":"string"}},"x-found-in":"body"},"labels":{"type":"object","properties":{},"additionalProperties":{},"x-found-in":"body"},"tags":{"type":"array","items":{"type":"string"},"x-found-in":"body"},"user":{"type":"object","properties":{"domain":{"type":"array","items":{"type":"string"},"description":"Observed user domains."},"email":{"type":"array","items":{"type":"string"},"description":"Observed email addresses."},"full_name":{"type":"array","items":{"type":"string"},"description":"Observed full names of the user."},"hash":{"type":"array","items":{"type":"string"},"description":"Observed user hashes."},"id":{"type":"array","items":{"type":"string"},"description":"Observed user identifiers."},"name":{"type":"string","description":"Primary user name."},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"],"description":"Lexical description of the entity's risk."},"calculated_score":{"type":"number","description":"The raw numeric value of the given entity's risk score."},"calculated_score_norm":{"type":"number","description":"The normalized numeric value of the given entity's risk score."}}},"roles":{"type":"array","items":{"type":"string"},"description":"Observed roles assigned to the user."}},"description":"Elastic Common Schema (ECS) user fields collected on the entity.","x-found-in":"body"},"host":{"type":"object","properties":{"architecture":{"type":"array","items":{"type":"string"},"description":"Observed CPU architectures."},"domain":{"type":"array","items":{"type":"string"},"description":"Observed host domains."},"hostname":{"type":"array","items":{"type":"string"},"description":"Observed hostnames."},"id":{"type":"array","items":{"type":"string"},"description":"Observed host identifiers."},"ip":{"type":"array","items":{"type":"string"},"description":"Observed IP addresses."},"mac":{"type":"array","items":{"type":"string"},"description":"Observed MAC addresses."},"name":{"type":"string","description":"Primary host name."},"os":{"type":"object","properties":{"family":{"type":"string"},"full":{"type":"string"},"kernel":{"type":"string"},"name":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"platform":{"type":"string"},"type":{"oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"version":{"type":"string"}},"description":"Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2)."},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"],"description":"Lexical description of the entity's risk."},"calculated_score":{"type":"number","description":"The raw numeric value of the given entity's risk score."},"calculated_score_norm":{"type":"number","description":"The normalized numeric value of the given entity's risk score."}}},"type":{"type":"array","items":{"type":"string"},"description":"Observed host types."}},"description":"Elastic Common Schema (ECS) host fields collected on the entity.","x-found-in":"body"},"service":{"type":"object","properties":{"address":{"type":"string","description":"Service address."},"environment":{"type":"string","description":"Service environment (for example, production, staging)."},"ephemeral_id":{"type":"string","description":"Ephemeral identifier of the service."},"id":{"type":"string","description":"Unique identifier of the service."},"name":{"type":"string","description":"Primary service name."},"node":{"type":"object","properties":{"name":{"type":"string","description":"Node name."},"role":{"type":"string","description":"Node role."},"roles":{"type":"array","items":{"type":"string"},"description":"Node roles."}},"description":"Node information for the service."},"risk":{"type":"object","properties":{"calculated_level":{"enum":["Unknown","Low","Moderate","High","Critical"],"description":"Lexical description of the entity's risk."},"calculated_score":{"type":"number","description":"The raw numeric value of the given entity's risk score."},"calculated_score_norm":{"type":"number","description":"The normalized numeric value of the given entity's risk score."}}},"state":{"type":"string","description":"Current state of the service."},"type":{"type":"string","description":"Service type."},"version":{"type":"string","description":"Service version."}},"description":"Elastic Common Schema (ECS) service fields collected on the entity.","x-found-in":"body"},"cloud":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"availability_zone":{"type":"string"},"instance":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"machine":{"type":"object","properties":{"type":{"type":"string"}}},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}}},"provider":{"type":"string"},"region":{"type":"string"},"service":{"type":"object","properties":{"name":{"type":"string"}}}},"description":"Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.","x-found-in":"body"},"orchestrator":{"type":"object","properties":{"api_version":{"type":"string"},"cluster":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"version":{"type":"string"}}},"namespace":{"type":"string"},"organization":{"type":"string"},"resource":{"type":"object","properties":{"annotation":{"type":"string"},"id":{"type":"string"},"ip":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"parent":{"type":"object","properties":{"type":{"type":"string"}}},"type":{"type":"string"}}},"type":{"type":"string"}},"description":"Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.","x-found-in":"body"}},"required":["entityType"]}

package/src/kibana/json/security-entity-store.post-security-entity-store-install.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-install","x-api":{"id":"security-entity-store.post-security-entity-store-install","name":"post-security-entity-store-install","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/install","x-destructive":true,"type":"object","properties":{"entityTypes":{"type":"array","items":{"enum":["user","host","service","generic"]},"x-found-in":"body"},"historySnapshot":{"type":"object","properties":{"frequency":{"type":"string"}},"x-found-in":"body"},"logExtraction":{"type":"object","properties":{"additionalIndexPatterns":{"type":"array","items":{"type":"string"}},"delay":{"type":"string"},"docsLimit":{"type":"number"},"excludedIndexPatterns":{"type":"array","items":{"type":"string"}},"fieldHistoryLength":{"type":"number"},"frequency":{"type":"string"},"lookbackPeriod":{"type":"string"},"maxLogsPerPage":{"type":"number"},"maxLogsPerWindow":{"type":"number"},"maxLogsPerWindowCapBehavior":{"enum":["defer","drop"]},"maxTimeWindowSize":{"type":"string"}},"x-found-in":"body"}}}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-security-entity-store-install","x-api":{"id":"security-entity-store.post-security-entity-store-install","name":"post-security-entity-store-install","namespace":"security-entity-store"},"x-method":"POST","x-path":"/api/security/entity_store/install","x-destructive":true,"type":"object","properties":{"entityTypes":{"type":"array","items":{"enum":["user","host","service","generic"]},"x-found-in":"body"},"historySnapshot":{"type":"object","properties":{"frequency":{"type":"string"}},"x-found-in":"body"},"logExtraction":{"type":"object","properties":{"additionalIndexPatterns":{"oneOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}]},"delay":{"oneOf":[{"type":"string"},{"type":"null"}]},"docsLimit":{"oneOf":[{"type":"number"},{"type":"null"}]},"excludedIndexPatterns":{"oneOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}]},"fieldHistoryLength":{"oneOf":[{"type":"number"},{"type":"null"}]},"frequency":{"oneOf":[{"type":"string"},{"type":"null"}]},"lookbackPeriod":{"oneOf":[{"type":"string"},{"type":"null"}]},"maxLogsPerPage":{"oneOf":[{"type":"number"},{"type":"null"}]},"maxLogsPerWindow":{"oneOf":[{"type":"number"},{"type":"null"}]},"maxLogsPerWindowCapBehavior":{"enum":["defer","drop",null]},"maxTimeWindowSize":{"oneOf":[{"type":"string"},{"type":"null"}]}},"x-found-in":"body"}}}