[8.6] [DOCS] Create open API specification for run connector (#149274) (#149614)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[DOCS] Create open API specification for run connector
(#149274)](https://github.com/elastic/kibana/pull/149274)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Lisa
Cawley","email":"lcawley@elastic.co"},"sourceCommit":{"committedDate":"2023-01-26T16:53:47Z","message":"[DOCS]
Create open API specification for run connector
(#149274)","sha":"f78236a2e4c1532a9a135444bea95a0f89d1047e","branchLabelMapping":{"^v8.7.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:ResponseOps","docs","Feature:Actions/ConnectorsManagement","backport:prev-minor","v8.7.0"],"number":149274,"url":"https://github.com/elastic/kibana/pull/149274","mergeCommit":{"message":"[DOCS]
Create open API specification for run connector
(#149274)","sha":"f78236a2e4c1532a9a135444bea95a0f89d1047e"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.7.0","labelRegex":"^v8.7.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/149274","number":149274,"mergeCommit":{"message":"[DOCS]
Create open API specification for run connector
(#149274)","sha":"f78236a2e4c1532a9a135444bea95a0f89d1047e"}}]}]
BACKPORT-->

Co-authored-by: Lisa Cawley <lcawley@elastic.co>
This commit is contained in:
Kibana Machine 2023-01-26 13:27:54 -05:00 committed by GitHub
parent 0dbc120be6
commit 3206fa8900
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
35 changed files with 3172 additions and 257 deletions

View file

@ -23,6 +23,7 @@ Any modifications made to this file will be overwritten.
<li><a href="#getConnector"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></a></li>
<li><a href="#getConnectorTypes"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/connector_types</code></a></li>
<li><a href="#getConnectors"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/connectors</code></a></li>
<li><a href="#runConnector"><code><span class="http-method">post</span> /s/{spaceId}/api/actions/connector/{connectorId}/_execute</code></a></li>
<li><a href="#updateConnector"><code><span class="http-method">put</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></a></li>
</ul>
@ -90,7 +91,7 @@ Any modifications made to this file will be overwritten.
<a href="#connector_response_properties">connector_response_properties</a>
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#createConnector_401_response">createConnector_401_response</a>
<a href="#401_response">401_response</a>
</div> <!-- method -->
<hr/>
<div class="method"><a name="deleteConnector"/>
@ -138,7 +139,7 @@ Any modifications made to this file will be overwritten.
<a href="#"></a>
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#createConnector_401_response">createConnector_401_response</a>
<a href="#401_response">401_response</a>
<h4 class="field-label">404</h4>
Object is not found.
<a href="#getConnector_404_response">getConnector_404_response</a>
@ -190,7 +191,7 @@ Any modifications made to this file will be overwritten.
<a href="#connector_response_properties">connector_response_properties</a>
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#createConnector_401_response">createConnector_401_response</a>
<a href="#401_response">401_response</a>
<h4 class="field-label">404</h4>
Object is not found.
<a href="#getConnector_404_response">getConnector_404_response</a>
@ -254,7 +255,7 @@ Any modifications made to this file will be overwritten.
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#createConnector_401_response">createConnector_401_response</a>
<a href="#401_response">401_response</a>
</div> <!-- method -->
<hr/>
<div class="method"><a name="getConnectors"/>
@ -312,7 +313,78 @@ Any modifications made to this file will be overwritten.
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#createConnector_401_response">createConnector_401_response</a>
<a href="#401_response">401_response</a>
</div> <!-- method -->
<hr/>
<div class="method"><a name="runConnector"/>
<div class="method-path">
<a class="up" href="#__Methods">Up</a>
<pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/actions/connector/{connectorId}/_execute</code></pre></div>
<div class="method-summary">Runs a connector. (<span class="nickname">runConnector</span>)</div>
<div class="method-notes">You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have <code>read</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges. If you use an index connector, you must also have <code>all</code>, <code>create</code>, <code>index</code>, or <code>write</code> indices privileges.</div>
<h3 class="field-label">Path parameters</h3>
<div class="field-items">
<div class="param">connectorId (required)</div>
<div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. default: null </div><div class="param">spaceId (required)</div>
<div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
</div> <!-- field-items -->
<h3 class="field-label">Consumes</h3>
This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
<ul>
<li><code>application/json</code></li>
</ul>
<h3 class="field-label">Request body</h3>
<div class="field-items">
<div class="param">Run_connector_request_body_properties <a href="#Run_connector_request_body_properties">Run_connector_request_body_properties</a> (required)</div>
<div class="param-desc"><span class="param-type">Body Parameter</span> &mdash; </div>
</div> <!-- field-items -->
<h3 class="field-label">Request headers</h3>
<div class="field-items">
<div class="param">kbn-xsrf (required)</div>
<div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; default: null </div>
</div> <!-- field-items -->
<h3 class="field-label">Return type</h3>
<div class="return-type">
<a href="#runConnector_200_response">runConnector_200_response</a>
</div>
<!--Todo: process Response Object and its headers, schema, examples -->
<h3 class="field-label">Example data</h3>
<div class="example-data-content-type">Content-Type: application/json</div>
<pre class="example"><code>{
"connector_id" : "connector_id",
"status" : "error"
}</code></pre>
<h3 class="field-label">Produces</h3>
This API call produces the following media types according to the <span class="header">Accept</span> request header;
the media type will be conveyed by the <span class="header">Content-Type</span> response header.
<ul>
<li><code>application/json</code></li>
</ul>
<h3 class="field-label">Responses</h3>
<h4 class="field-label">200</h4>
Indicates a successful call.
<a href="#runConnector_200_response">runConnector_200_response</a>
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#401_response">401_response</a>
</div> <!-- method -->
<hr/>
<div class="method"><a name="updateConnector"/>
@ -383,10 +455,10 @@ Any modifications made to this file will be overwritten.
<a href="#updateConnector_400_response">updateConnector_400_response</a>
<h4 class="field-label">401</h4>
Authorization information is missing or invalid.
<a href="#createConnector_401_response">createConnector_401_response</a>
<a href="#401_response">401_response</a>
<h4 class="field-label">404</h4>
Object is not found.
<a href="#getConnector_404_response">getConnector_404_response</a>
<a href="#404_response">404_response</a>
</div> <!-- method -->
<hr/>
@ -395,6 +467,8 @@ Any modifications made to this file will be overwritten.
<h3>Table of Contents</h3>
<ol>
<li><a href="#401_response"><code>401_response</code> - Unsuccessful rule API response</a></li>
<li><a href="#404_response"><code>404_response</code> - </a></li>
<li><a href="#Alert_identifier_mapping"><code>Alert_identifier_mapping</code> - Alert identifier mapping</a></li>
<li><a href="#Case_comment_mapping"><code>Case_comment_mapping</code> - Case comment mapping</a></li>
<li><a href="#Case_description_mapping"><code>Case_description_mapping</code> - Case description mapping</a></li>
@ -405,7 +479,10 @@ Any modifications made to this file will be overwritten.
<li><a href="#Get_connector_types_response_body_properties_inner"><code>Get_connector_types_response_body_properties_inner</code> - </a></li>
<li><a href="#Get_connectors_response_body_properties"><code>Get_connectors_response_body_properties</code> - Get connectors response body properties</a></li>
<li><a href="#Rule_name_mapping"><code>Rule_name_mapping</code> - Rule name mapping</a></li>
<li><a href="#Run_connector_request_body_properties"><code>Run_connector_request_body_properties</code> - Run connector request body properties</a></li>
<li><a href="#Run_connector_request_body_properties_params"><code>Run_connector_request_body_properties_params</code> - </a></li>
<li><a href="#Severity_mapping"><code>Severity_mapping</code> - Severity mapping</a></li>
<li><a href="#Subaction_parameters"><code>Subaction_parameters</code> - Subaction parameters</a></li>
<li><a href="#Update_connector_request_body_properties"><code>Update_connector_request_body_properties</code> - Update connector request body properties</a></li>
<li><a href="#config_properties_cases_webhook"><code>config_properties_cases_webhook</code> - Connector request properties for Webhook - Case Management connector</a></li>
<li><a href="#config_properties_index"><code>config_properties_index</code> - Connector request properties for an index connector</a></li>
@ -434,7 +511,6 @@ Any modifications made to this file will be overwritten.
<li><a href="#connector_response_properties_webhook"><code>connector_response_properties_webhook</code> - Connector response properties for a Webhook connector</a></li>
<li><a href="#connector_response_properties_xmatters"><code>connector_response_properties_xmatters</code> - Connector response properties for an xMatters connector</a></li>
<li><a href="#connector_types"><code>connector_types</code> - Connector types</a></li>
<li><a href="#createConnector_401_response"><code>createConnector_401_response</code> - </a></li>
<li><a href="#create_connector_request_cases_webhook"><code>create_connector_request_cases_webhook</code> - Create Webhook - Case Managment connector request</a></li>
<li><a href="#create_connector_request_email"><code>create_connector_request_email</code> - Create email connector request</a></li>
<li><a href="#create_connector_request_index"><code>create_connector_request_index</code> - Create index connector request</a></li>
@ -454,6 +530,38 @@ Any modifications made to this file will be overwritten.
<li><a href="#create_connector_request_xmatters"><code>create_connector_request_xmatters</code> - Create xMatters connector request</a></li>
<li><a href="#features"><code>features</code> - </a></li>
<li><a href="#getConnector_404_response"><code>getConnector_404_response</code> - </a></li>
<li><a href="#runConnector_200_response"><code>runConnector_200_response</code> - </a></li>
<li><a href="#runConnector_200_response_data"><code>runConnector_200_response_data</code> - </a></li>
<li><a href="#run_connector_params_documents"><code>run_connector_params_documents</code> - Index connector parameters</a></li>
<li><a href="#run_connector_params_level_message"><code>run_connector_params_level_message</code> - Server log connector parameters</a></li>
<li><a href="#run_connector_subaction_addevent"><code>run_connector_subaction_addevent</code> - The addEvent subaction</a></li>
<li><a href="#run_connector_subaction_addevent_subActionParams"><code>run_connector_subaction_addevent_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_closealert"><code>run_connector_subaction_closealert</code> - The closeAlert subaction</a></li>
<li><a href="#run_connector_subaction_closealert_subActionParams"><code>run_connector_subaction_closealert_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_createalert"><code>run_connector_subaction_createalert</code> - The createAlert subaction</a></li>
<li><a href="#run_connector_subaction_createalert_subActionParams"><code>run_connector_subaction_createalert_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_createalert_subActionParams_responders_inner"><code>run_connector_subaction_createalert_subActionParams_responders_inner</code> - </a></li>
<li><a href="#run_connector_subaction_createalert_subActionParams_visibleTo_inner"><code>run_connector_subaction_createalert_subActionParams_visibleTo_inner</code> - </a></li>
<li><a href="#run_connector_subaction_fieldsbyissuetype"><code>run_connector_subaction_fieldsbyissuetype</code> - The fieldsByIssueType subaction</a></li>
<li><a href="#run_connector_subaction_fieldsbyissuetype_subActionParams"><code>run_connector_subaction_fieldsbyissuetype_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_getchoices"><code>run_connector_subaction_getchoices</code> - The getChoices subaction</a></li>
<li><a href="#run_connector_subaction_getchoices_subActionParams"><code>run_connector_subaction_getchoices_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_getfields"><code>run_connector_subaction_getfields</code> - The getFields subaction</a></li>
<li><a href="#run_connector_subaction_getincident"><code>run_connector_subaction_getincident</code> - The getIncident subaction</a></li>
<li><a href="#run_connector_subaction_getincident_subActionParams"><code>run_connector_subaction_getincident_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_issue"><code>run_connector_subaction_issue</code> - The issue subaction</a></li>
<li><a href="#run_connector_subaction_issue_subActionParams"><code>run_connector_subaction_issue_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_issues"><code>run_connector_subaction_issues</code> - The issues subaction</a></li>
<li><a href="#run_connector_subaction_issues_subActionParams"><code>run_connector_subaction_issues_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_issuetypes"><code>run_connector_subaction_issuetypes</code> - The issueTypes subaction</a></li>
<li><a href="#run_connector_subaction_pushtoservice"><code>run_connector_subaction_pushtoservice</code> - The pushToService subaction</a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams"><code>run_connector_subaction_pushtoservice_subActionParams</code> - </a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams_comments_inner"><code>run_connector_subaction_pushtoservice_subActionParams_comments_inner</code> - </a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident"><code>run_connector_subaction_pushtoservice_subActionParams_incident</code> - </a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip</code> - </a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash</code> - </a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_url"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_url</code> - </a></li>
<li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_source_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_source_ip</code> - </a></li>
<li><a href="#secrets_properties_cases_webhook"><code>secrets_properties_cases_webhook</code> - Connector secrets properties for Webhook - Case Management connector</a></li>
<li><a href="#secrets_properties_jira"><code>secrets_properties_jira</code> - Connector secrets properties for a Jira connector</a></li>
<li><a href="#secrets_properties_opsgenie"><code>secrets_properties_opsgenie</code> - Connector secrets properties for an Opsgenie connector</a></li>
@ -472,6 +580,32 @@ Any modifications made to this file will be overwritten.
<li><a href="#update_connector_request_swimlane"><code>update_connector_request_swimlane</code> - Update Swimlane connector request</a></li>
</ol>
<div class="model">
<h3><a name="401_response"><code>401_response</code> - Unsuccessful rule API response</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">Unauthorized</div>
<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> </div>
<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">401</div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="404_response"><code>404_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">Not Found</div>
<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> </div>
<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">404</div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="Alert_identifier_mapping"><code>Alert_identifier_mapping</code> - Alert identifier mapping</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>Mapping for the alert ID.</div>
@ -584,6 +718,28 @@ Any modifications made to this file will be overwritten.
<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="Run_connector_request_body_properties"><code>Run_connector_request_body_properties</code> - Run connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The properties vary depending on the connector type.</div>
<div class="field-items">
<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#Run_connector_request_body_properties_params">Run_connector_request_body_properties_params</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="Run_connector_request_body_properties_params"><code>Run_connector_request_body_properties_params</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">documents </div><div class="param-desc"><span class="param-type"><a href="#map">array[map[String, oas_any_type_not_mapped]]</a></span> The documents in JSON format for index connectors. </div>
<div class="param">level (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The log level of the message for server log connectors. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">debug</div><div class="param-enum">error</div><div class="param-enum">fatal</div><div class="param-enum">info</div><div class="param-enum">trace</div><div class="param-enum">warn</div>
<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The message for server log connectors. </div>
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">pushToService</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams">run_connector_subaction_pushtoservice_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="Severity_mapping"><code>Severity_mapping</code> - Severity mapping</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>Mapping for the severity.</div>
@ -594,6 +750,16 @@ Any modifications made to this file will be overwritten.
<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="Subaction_parameters"><code>Subaction_parameters</code> - Subaction parameters</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>Test an action that involves a subaction.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">pushToService</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams">run_connector_subaction_pushtoservice_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="Update_connector_request_body_properties"><code>Update_connector_request_body_properties</code> - Update connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The properties vary depending on the connector type.</div>
@ -971,15 +1137,6 @@ Any modifications made to this file will be overwritten.
<div class="field-items">
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="createConnector_401_response"><code>createConnector_401_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> </div>
<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> </div>
<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="create_connector_request_cases_webhook"><code>create_connector_request_cases_webhook</code> - Create Webhook - Case Managment connector request</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The Webhook - Case Management connector uses axios to send POST, PUT, and GET requests to a case management RESTful API web service.</div>
@ -1194,6 +1351,325 @@ Any modifications made to this file will be overwritten.
<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="runConnector_200_response"><code>runConnector_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">connector_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
<div class="param">data (optional)</div><div class="param-desc"><span class="param-type"><a href="#runConnector_200_response_data">runConnector_200_response_data</a></span> </div>
<div class="param">status </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The status of the action. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">error</div><div class="param-enum">ok</div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="runConnector_200_response_data"><code>runConnector_200_response_data</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_params_documents"><code>run_connector_params_documents</code> - Index connector parameters</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>Test an action that indexes a document into Elasticsearch.</div>
<div class="field-items">
<div class="param">documents </div><div class="param-desc"><span class="param-type"><a href="#map">array[map[String, oas_any_type_not_mapped]]</a></span> The documents in JSON format for index connectors. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_params_level_message"><code>run_connector_params_level_message</code> - Server log connector parameters</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>Test an action that writes an entry to the Kibana server log.</div>
<div class="field-items">
<div class="param">level (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The log level of the message for server log connectors. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">debug</div><div class="param-enum">error</div><div class="param-enum">fatal</div><div class="param-enum">info</div><div class="param-enum">trace</div><div class="param-enum">warn</div>
<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The message for server log connectors. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_addevent"><code>run_connector_subaction_addevent</code> - The addEvent subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>addEvent</code> subaction for ServiceNow ITOM connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">addEvent</div>
<div class="param">subActionParams (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_addevent_subActionParams">run_connector_subaction_addevent_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_addevent_subActionParams"><code>run_connector_subaction_addevent_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The set of configuration properties for the action.</div>
<div class="field-items">
<div class="param">additional_info (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Additional information about the event. </div>
<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The details about the event. </div>
<div class="param">event_class (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A specific instance of the source. </div>
<div class="param">message_key (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> All actions sharing this key are associated with the same ServiceNow alert. The default value is <code>&lt;rule ID&gt;:&lt;alert instance ID&gt;</code>. </div>
<div class="param">metric_name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the metric. </div>
<div class="param">node (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The host that the event was triggered for. </div>
<div class="param">resource (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the resource. </div>
<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity of the event. </div>
<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the event source type. </div>
<div class="param">time_of_event (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The time of the event. </div>
<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of event. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_closealert"><code>run_connector_subaction_closealert</code> - The closeAlert subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>closeAlert</code> subaction for Opsgenie connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">closeAlert</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_closealert_subActionParams">run_connector_subaction_closealert_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_closealert_subActionParams"><code>run_connector_subaction_closealert_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">alias </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert. </div>
<div class="param">note (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Additional information for the alert. </div>
<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the source of the alert. </div>
<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the owner. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_createalert"><code>run_connector_subaction_createalert</code> - The createAlert subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>createAlert</code> subaction for Opsgenie connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">createAlert</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_createalert_subActionParams">run_connector_subaction_createalert_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_createalert_subActionParams"><code>run_connector_subaction_createalert_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The custom actions available to the alert. </div>
<div class="param">alias (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier used for alert deduplication in Opsgenie. </div>
<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A description that provides detailed information about the alert. </div>
<div class="param">details (optional)</div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The custom properties of the alert. </div>
<div class="param">entity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The domain of the alert. For example, the application or server name. </div>
<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The alert message. </div>
<div class="param">note (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Additional information for the alert. </div>
<div class="param">priority (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority level for the alert. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">P1</div><div class="param-enum">P2</div><div class="param-enum">P3</div><div class="param-enum">P4</div><div class="param-enum">P5</div>
<div class="param">responders (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_createalert_subActionParams_responders_inner">array[run_connector_subaction_createalert_subActionParams_responders_inner]</a></span> The entities to receive notifications about the alert. If <code>type</code> is <code>user</code>, either <code>id</code> or <code>username</code> is required. If <code>type</code> is <code>team</code>, either <code>id</code> or <code>name</code> is required. </div>
<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the source of the alert. </div>
<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the alert. </div>
<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the owner. </div>
<div class="param">visibleTo (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_createalert_subActionParams_visibleTo_inner">array[run_connector_subaction_createalert_subActionParams_visibleTo_inner]</a></span> The teams and users that the alert will be visible to without sending a notification. Only one of <code>id</code>, <code>name</code>, or <code>username</code> is required. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_createalert_subActionParams_responders_inner"><code>run_connector_subaction_createalert_subActionParams_responders_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the entity. </div>
<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the entity. </div>
<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of responders, in this case <code>escalation</code>. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">escalation</div><div class="param-enum">schedule</div><div class="param-enum">team</div><div class="param-enum">user</div>
<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A valid email address for the user. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_createalert_subActionParams_visibleTo_inner"><code>run_connector_subaction_createalert_subActionParams_visibleTo_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the entity. </div>
<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the entity. </div>
<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Valid values are <code>team</code> and <code>user</code>. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">team</div><div class="param-enum">user</div>
<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The user name. This property is required only when the <code>type</code> is <code>user</code>. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_fieldsbyissuetype"><code>run_connector_subaction_fieldsbyissuetype</code> - The fieldsByIssueType subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>fieldsByIssueType</code> subaction for Jira connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">fieldsByIssueType</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_fieldsbyissuetype_subActionParams">run_connector_subaction_fieldsbyissuetype_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_fieldsbyissuetype_subActionParams"><code>run_connector_subaction_fieldsbyissuetype_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira issue type identifier. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_getchoices"><code>run_connector_subaction_getchoices</code> - The getChoices subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>getChoices</code> subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">getChoices</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_getchoices_subActionParams">run_connector_subaction_getchoices_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_getchoices_subActionParams"><code>run_connector_subaction_getchoices_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The set of configuration properties for the action.</div>
<div class="field-items">
<div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> An array of fields. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_getfields"><code>run_connector_subaction_getfields</code> - The getFields subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>getFields</code> subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">getFields</div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_getincident"><code>run_connector_subaction_getincident</code> - The getIncident subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>getIncident</code> subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">getIncident</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_getincident_subActionParams">run_connector_subaction_getincident_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_getincident_subActionParams"><code>run_connector_subaction_getincident_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">externalId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_issue"><code>run_connector_subaction_issue</code> - The issue subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>issue</code> subaction for Jira connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">issue</div>
<div class="param">subActionParams (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_issue_subActionParams">run_connector_subaction_issue_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_issue_subActionParams"><code>run_connector_subaction_issue_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira issue identifier. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_issues"><code>run_connector_subaction_issues</code> - The issues subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>issues</code> subaction for Jira connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">issues</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_issues_subActionParams">run_connector_subaction_issues_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_issues_subActionParams"><code>run_connector_subaction_issues_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">title </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The title of the Jira issue. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_issuetypes"><code>run_connector_subaction_issuetypes</code> - The issueTypes subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>issueTypes</code> subaction for Jira connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">issueTypes</div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice"><code>run_connector_subaction_pushtoservice</code> - The pushToService subaction</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The <code>pushToService</code> subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.</div>
<div class="field-items">
<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
<div class="param-enum-header">Enum:</div>
<div class="param-enum">pushToService</div>
<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams">run_connector_subaction_pushtoservice_subActionParams</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams"><code>run_connector_subaction_pushtoservice_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>The set of configuration properties for the action.</div>
<div class="field-items">
<div class="param">comments (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_comments_inner">array[run_connector_subaction_pushtoservice_subActionParams_comments_inner]</a></span> Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane. </div>
<div class="param">incident (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident">run_connector_subaction_pushtoservice_subActionParams_incident</a></span> </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams_comments_inner"><code>run_connector_subaction_pushtoservice_subActionParams_comments_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>
<div class="field-items">
<div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A comment related to the incident. For example, describe how to troubleshoot the issue. </div>
<div class="param">commentId (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> A unique identifier for the comment. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident"><code>run_connector_subaction_pushtoservice_subActionParams_incident</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.</div>
<div class="field-items">
<div class="param">alertId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The alert identifier for Swimlane connectors. </div>
<div class="param">caseId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case identifier for the incident for Swimlane connectors. </div>
<div class="param">caseName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case name for the incident for Swimlane connectors. </div>
<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
<div class="param">correlation_display (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
<div class="param">correlation_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as <code>{{ruleID}}:{{alert ID}}</code> to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of <code>{{ruleID}}:{{alert ID}}</code> ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. </div>
<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors. </div>
<div class="param">dest_ip (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip">run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip</a></span> </div>
<div class="param">externalId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created. </div>
<div class="param">impact (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The impact of the incident for ServiceNow ITSM connectors. </div>
<div class="param">issueType (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set <code>subAction</code> to <code>issueTypes</code>. </div>
<div class="param">labels (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces. </div>
<div class="param">malware_hash (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash">run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash</a></span> </div>
<div class="param">malware_url (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_url">run_connector_subaction_pushtoservice_subActionParams_incident_malware_url</a></span> </div>
<div class="param">parent (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID or key of the parent issue for Jira connectors. Applies only to <code>Sub-task</code> types of issues. </div>
<div class="param">priority (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority of the incident in Jira and ServiceNow SecOps connectors. </div>
<div class="param">ruleName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The rule name for Swimlane connectors. </div>
<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity of the incident for ServiceNow ITSM and Swimlane connectors. </div>
<div class="param">short_description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base. </div>
<div class="param">source_ip (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_source_ip">run_connector_subaction_pushtoservice_subActionParams_incident_source_ip</a></span> </div>
<div class="param">subcategory (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
<div class="param">summary (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A summary of the incident for Jira connectors. </div>
<div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base. </div>
<div class="param">urgency (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The urgency of the incident for ServiceNow ITSM connectors. </div>
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.</div>
<div class="field-items">
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.</div>
<div class="field-items">
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_malware_url"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_url</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.</div>
<div class="field-items">
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_source_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_source_ip</code> - </a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'>A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.</div>
<div class="field-items">
</div> <!-- field-items -->
</div>
<div class="model">
<h3><a name="secrets_properties_cases_webhook"><code>secrets_properties_cases_webhook</code> - Connector secrets properties for Webhook - Case Management connector</a> <a class="up" href="#__Models">Up</a></h3>
<div class='model-description'></div>

View file

@ -6,6 +6,12 @@
Runs a connector by ID.
[NOTE]
====
For the most up-to-date API details, refer to the
{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
====
[[execute-connector-api-request]]
=== {api-request-title}
@ -362,7 +368,7 @@ on the `subAction` value. This object is not required when `subAction` is
[%collapsible%open]
======
`comments`:::
(Optional, array of objects) Additional information that is sent to {sn-sir}.
(Optional, array of objects) Additional information that is sent to {sn-itsm}.
+
.Properties of `comments`
[%collapsible%open]
@ -381,7 +387,7 @@ version::::
=======
`incident`:::
(Required, object) Information necessary to create or update a {sn-sir} incident.
(Required, object) Information necessary to create or update a {sn-itsm} incident.
+
.Properties of `incident`
[%collapsible%open]
@ -520,6 +526,10 @@ to the security incident. The IPs are added as observables to the security incid
updated. Otherwise, a new incident is created.
`malware_hash`::::
(Optional, string or array of strings) A list of malware hashes related to the
security incident. The hashes are added as observables to the security incident.
`malware_url`::::
(Optional, string or array of strings) A list of malware URLs related to the
security incident. The URLs are added as observables to the security incident.

File diff suppressed because it is too large Load diff

View file

@ -71,16 +71,7 @@ paths:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '#/components/schemas/401_response'
servers:
- url: https://localhost:5601
servers:
@ -111,16 +102,7 @@ paths:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '#/components/schemas/401_response'
'404':
description: Object is not found.
content:
@ -158,16 +140,7 @@ paths:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '#/components/schemas/401_response'
'404':
description: Object is not found.
content:
@ -245,32 +218,13 @@ paths:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '#/components/schemas/401_response'
'404':
description: Object is not found.
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Not Found
message:
type: string
example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found
statusCode:
type: integer
example: 404
$ref: '#/components/schemas/404_response'
servers:
- url: https://localhost:5601
servers:
@ -338,16 +292,7 @@ paths:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '#/components/schemas/401_response'
servers:
- url: https://localhost:5601
servers:
@ -415,19 +360,114 @@ paths:
$ref: '#/components/examples/get_connector_types_response'
'401':
description: Authorization information is missing or invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/401_response'
servers:
- url: https://localhost:5601
servers:
- url: https://localhost:5601
/s/{spaceId}/api/actions/connector/{connectorId}/_execute:
post:
summary: Runs a connector.
operationId: runConnector
description: |
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.
tags:
- connectors
parameters:
- $ref: '#/components/parameters/kbn_xsrf'
- $ref: '#/components/parameters/connector_id'
- $ref: '#/components/parameters/space_id'
requestBody:
required: true
content:
application/json:
schema:
title: Run connector request body properties
description: The properties vary depending on the connector type.
type: object
required:
- params
properties:
params:
oneOf:
- $ref: '#/components/schemas/run_connector_params_documents'
- $ref: '#/components/schemas/run_connector_params_level_message'
- title: Subaction parameters
description: Test an action that involves a subaction.
oneOf:
- $ref: '#/components/schemas/run_connector_subaction_addevent'
- $ref: '#/components/schemas/run_connector_subaction_closealert'
- $ref: '#/components/schemas/run_connector_subaction_createalert'
- $ref: '#/components/schemas/run_connector_subaction_fieldsbyissuetype'
- $ref: '#/components/schemas/run_connector_subaction_getchoices'
- $ref: '#/components/schemas/run_connector_subaction_getfields'
- $ref: '#/components/schemas/run_connector_subaction_getincident'
- $ref: '#/components/schemas/run_connector_subaction_issue'
- $ref: '#/components/schemas/run_connector_subaction_issues'
- $ref: '#/components/schemas/run_connector_subaction_issuetypes'
- $ref: '#/components/schemas/run_connector_subaction_pushtoservice'
discriminator:
propertyName: subAction
examples:
runIndexConnectorRequest:
$ref: '#/components/examples/run_index_connector_request'
runJiraConnectorRequest:
$ref: '#/components/examples/run_jira_connector_request'
runServerLogConnectorRequest:
$ref: '#/components/examples/run_server_log_connector_request'
runServiceNowITOMConnectorRequest:
$ref: '#/components/examples/run_servicenow_itom_connector_request'
runSwimlaneConnectorRequest:
$ref: '#/components/examples/run_swimlane_connector_request'
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
required:
- connector_id
- status
properties:
error:
connector_id:
type: string
example: Unauthorized
message:
description: The identifier for the connector.
data:
oneOf:
- type: object
description: Information returned from the action.
additionalProperties: true
- type: array
description: An array of information returned from the action.
items:
type: object
status:
type: string
statusCode:
type: integer
example: 401
description: The status of the action.
enum:
- error
- ok
examples:
runIndexConnectorResponse:
$ref: '#/components/examples/run_index_connector_response'
runJiraConnectorResponse:
$ref: '#/components/examples/run_jira_connector_response'
runServerLogConnectorResponse:
$ref: '#/components/examples/run_server_log_connector_response'
runServiceNowITOMConnectorResponse:
$ref: '#/components/examples/run_servicenow_itom_connector_response'
runSwimlaneConnectorResponse:
$ref: '#/components/examples/run_swimlane_connector_response'
'401':
description: Authorization information is missing or invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/401_response'
servers:
- url: https://localhost:5601
servers:
@ -1951,6 +1991,22 @@ components:
- $ref: '#/components/schemas/connector_response_properties_xmatters'
discriminator:
propertyName: connector_type_id
401_response:
type: object
title: Unsuccessful rule API response
properties:
error:
type: string
example: Unauthorized
enum:
- Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
enum:
- 401
update_connector_request_cases_webhook:
title: Update Webhook - Case Managment connector request
type: object
@ -2078,6 +2134,22 @@ components:
example: my-connector
secrets:
$ref: '#/components/schemas/secrets_properties_swimlane'
404_response:
type: object
properties:
error:
type: string
example: Not Found
enum:
- Not Found
message:
type: string
example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found
statusCode:
type: integer
example: 404
enum:
- 404
connector_types:
title: Connector types
type: string
@ -2110,6 +2182,495 @@ components:
- cases
- uptime
- siem
run_connector_params_documents:
title: Index connector parameters
description: Test an action that indexes a document into Elasticsearch.
type: object
required:
- documents
properties:
documents:
type: array
description: The documents in JSON format for index connectors.
items:
type: object
additionalProperties: true
run_connector_params_level_message:
title: Server log connector parameters
description: Test an action that writes an entry to the Kibana server log.
type: object
required:
- message
properties:
level:
type: string
description: The log level of the message for server log connectors.
enum:
- debug
- error
- fatal
- info
- trace
- warn
default: info
message:
type: string
description: The message for server log connectors.
run_connector_subaction_addevent:
title: The addEvent subaction
type: object
required:
- subAction
description: The `addEvent` subaction for ServiceNow ITOM connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- addEvent
subActionParams:
type: object
description: The set of configuration properties for the action.
properties:
additional_info:
type: string
description: Additional information about the event.
description:
type: string
description: The details about the event.
event_class:
type: string
description: A specific instance of the source.
message_key:
type: string
description: All actions sharing this key are associated with the same ServiceNow alert. The default value is `<rule ID>:<alert instance ID>`.
metric_name:
type: string
description: The name of the metric.
node:
type: string
description: The host that the event was triggered for.
resource:
type: string
description: The name of the resource.
severity:
type: string
description: The severity of the event.
source:
type: string
description: The name of the event source type.
time_of_event:
type: string
description: The time of the event.
type:
type: string
description: The type of event.
run_connector_subaction_closealert:
title: The closeAlert subaction
type: object
required:
- subAction
- subActionParams
description: The `closeAlert` subaction for Opsgenie connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- closeAlert
subActionParams:
type: object
required:
- alias
properties:
alias:
type: string
description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
note:
type: string
description: Additional information for the alert.
source:
type: string
description: The display name for the source of the alert.
user:
type: string
description: The display name for the owner.
run_connector_subaction_createalert:
title: The createAlert subaction
type: object
required:
- subAction
- subActionParams
description: The `createAlert` subaction for Opsgenie connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- createAlert
subActionParams:
type: object
required:
- message
properties:
actions:
type: array
description: The custom actions available to the alert.
items:
type: string
alias:
type: string
description: The unique identifier used for alert deduplication in Opsgenie.
description:
type: string
description: A description that provides detailed information about the alert.
details:
type: object
description: The custom properties of the alert.
additionalProperties: true
example:
key1: value1
key2: value2
entity:
type: string
description: The domain of the alert. For example, the application or server name.
message:
type: string
description: The alert message.
note:
type: string
description: Additional information for the alert.
priority:
type: string
description: The priority level for the alert.
enum:
- P1
- P2
- P3
- P4
- P5
responders:
type: array
description: |
The entities to receive notifications about the alert. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.
items:
type: object
properties:
id:
type: string
description: The identifier for the entity.
name:
type: string
description: The name of the entity.
type:
type: string
description: The type of responders, in this case `escalation`.
enum:
- escalation
- schedule
- team
- user
username:
type: string
description: A valid email address for the user.
source:
type: string
description: The display name for the source of the alert.
tags:
type: array
description: The tags for the alert.
items:
type: string
user:
type: string
description: The display name for the owner.
visibleTo:
type: array
description: The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required.
items:
type: object
required:
- type
properties:
id:
type: string
description: The identifier for the entity.
name:
type: string
description: The name of the entity.
type:
type: string
description: Valid values are `team` and `user`.
enum:
- team
- user
username:
type: string
description: The user name. This property is required only when the `type` is `user`.
run_connector_subaction_fieldsbyissuetype:
title: The fieldsByIssueType subaction
type: object
required:
- subAction
- subActionParams
description: The `fieldsByIssueType` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- fieldsByIssueType
subActionParams:
type: object
required:
- id
properties:
id:
type: string
description: The Jira issue type identifier.
example: 10024
run_connector_subaction_getchoices:
title: The getChoices subaction
type: object
required:
- subAction
- subActionParams
description: The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getChoices
subActionParams:
type: object
description: The set of configuration properties for the action.
required:
- fields
properties:
fields:
type: array
description: An array of fields.
items:
type: string
run_connector_subaction_getfields:
title: The getFields subaction
type: object
required:
- subAction
description: The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getFields
run_connector_subaction_getincident:
title: The getIncident subaction
type: object
description: The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
required:
- subAction
- subActionParams
properties:
subAction:
type: string
description: The action to test.
enum:
- getIncident
subActionParams:
type: object
required:
- externalId
properties:
externalId:
type: string
description: The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
example: 71778
run_connector_subaction_issue:
title: The issue subaction
type: object
required:
- subAction
description: The `issue` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- issue
subActionParams:
type: object
required:
- id
properties:
id:
type: string
description: The Jira issue identifier.
example: 71778
run_connector_subaction_issues:
title: The issues subaction
type: object
required:
- subAction
- subActionParams
description: The `issues` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- issues
subActionParams:
type: object
required:
- title
properties:
title:
type: string
description: The title of the Jira issue.
run_connector_subaction_issuetypes:
title: The issueTypes subaction
type: object
required:
- subAction
description: The `issueTypes` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- issueTypes
run_connector_subaction_pushtoservice:
title: The pushToService subaction
type: object
required:
- subAction
- subActionParams
description: The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- pushToService
subActionParams:
type: object
description: The set of configuration properties for the action.
properties:
comments:
type: array
description: Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane.
items:
type: object
properties:
comment:
type: string
description: A comment related to the incident. For example, describe how to troubleshoot the issue.
commentId:
type: integer
description: A unique identifier for the comment.
incident:
type: object
description: Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.
properties:
alertId:
type: string
description: The alert identifier for Swimlane connectors.
caseId:
type: string
description: The case identifier for the incident for Swimlane connectors.
caseName:
type: string
description: The case name for the incident for Swimlane connectors.
category:
type: string
description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_display:
type: string
description: A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_id:
type: string
description: |
The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.
description:
type: string
description: The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
dest_ip:
description: |
A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
externalId:
type: string
description: |
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
impact:
type: string
description: The impact of the incident for ServiceNow ITSM connectors.
issueType:
type: integer
description: The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`.
labels:
type: array
items:
type: string
description: |
The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
malware_hash:
description: A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
malware_url:
type: string
description: A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
parent:
type: string
description: The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues.
priority:
type: string
description: The priority of the incident in Jira and ServiceNow SecOps connectors.
ruleName:
type: string
description: The rule name for Swimlane connectors.
severity:
type: string
description: The severity of the incident for ServiceNow ITSM and Swimlane connectors.
short_description:
type: string
description: |
A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
source_ip:
description: A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
subcategory:
type: string
description: The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
summary:
type: string
description: A summary of the incident for Jira connectors.
title:
type: string
description: |
A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base.
urgency:
type: string
description: The urgency of the incident for ServiceNow ITSM connectors.
examples:
create_index_connector_request:
summary: Create an index connector.
@ -2199,6 +2760,146 @@ components:
supported_feature_ids:
- alerting
- uptime
run_index_connector_request:
summary: Run an index connector.
value:
params:
documents:
- id: my_doc_id
name: my_doc_name
message: hello, world
run_jira_connector_request:
summary: Run a Jira connector to retrieve the list of issue types.
value:
params:
subAction: issueTypes
run_server_log_connector_request:
summary: Run a server log connector.
value:
params:
level: warn
message: Test warning message.
run_servicenow_itom_connector_request:
summary: Run a ServiceNow ITOM connector to retrieve the list of choices.
value:
params:
subAction: getChoices
subActionParams:
fields:
- severity
- urgency
run_swimlane_connector_request:
summary: Run a Swimlane connector to create an incident.
value:
params:
subAction: pushToService
subActionParams:
comments:
- commentId: 1
comment: A comment about the incident.
incident:
caseId: '1000'
caseName: Case name
description: Description of the incident.
run_index_connector_response:
summary: Response from running an index connector.
value:
connector_id: fd38c600-96a5-11ed-bb79-353b74189cba
data:
errors: false
items:
- create:
_id: 4JtvwYUBrcyxt2NnfW3y
_index: my-index
_primary_term: 1
_seq_no: 0
_shards:
failed: 0
successful: 1
total: 2
_version: 1
result: created
status: 201
took: 135
status: ok
run_jira_connector_response:
summary: Response from retrieving the list of issue types for a Jira connector.
value:
connector_id: b3aad810-edbe-11ec-82d1-11348ecbf4a6
data:
- id: 10024
name: Improvement
- id: 10006
name: Task
- id: 10007
name: Sub-task
- id: 10025
name: New Feature
- id: 10023
name: Bug
- id: 10000
name: Epic
status: ok
run_server_log_connector_response:
summary: Response from running a server log connector.
value:
connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907
status: ok
run_servicenow_itom_connector_response:
summary: Response from retrieving the list of choices for a ServiceNow ITOM connector.
value:
connector_id: 9d9be270-2fd2-11ed-b0e0-87533c532698
data:
- dependent_value: ''
element: severity
label: Critical
value: 1
- dependent_value: ''
element: severity
label: Major
value: 2
- dependent_value: ''
element: severity
label: Minor
value: 3
- dependent_value: ''
element: severity
label: Warning
value: 4
- dependent_value: ''
element: severity
label: OK
value: 5
- dependent_value: ''
element: severity
label: Clear
value: 0
- dependent_value: ''
element: urgency
label: 1 - High
value: 1
- dependent_value: ''
element: urgency
label: 2 - Medium
value: 2
- dependent_value: ''
element: urgency
label: 3 - Low
value: 3
status: ok
run_swimlane_connector_response:
summary: Response from creating a Swimlane incident.
value:
connector_id: a4746470-2f94-11ed-b0e0-87533c532698
data:
id: aKPmBHWzmdRQtx6Mx
title: TEST-457
url: https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx
pushedDate: '2022-09-08T16:52:27.866Z'
comments:
- commentId: 1
pushedDate: '2022-09-08T16:52:27.865Z'
status: ok
security:
- basicAuth: []
- apiKeyAuth: []

View file

@ -0,0 +1,7 @@
summary: Run an index connector.
value:
params:
documents:
- id: my_doc_id
name: my_doc_name
message: hello, world

View file

@ -0,0 +1,20 @@
summary: Response from running an index connector.
value:
connector_id: fd38c600-96a5-11ed-bb79-353b74189cba
data:
errors: false
items:
- create:
_id: 4JtvwYUBrcyxt2NnfW3y
_index: my-index
_primary_term: 1
_seq_no: 0
_shards:
failed: 0
successful: 1
total: 2
_version: 1
result: created
status: 201
took: 135
status: ok

View file

@ -0,0 +1,4 @@
summary: Run a Jira connector to retrieve the list of issue types.
value:
params:
subAction: issueTypes

View file

@ -0,0 +1,17 @@
summary: Response from retrieving the list of issue types for a Jira connector.
value:
connector_id: b3aad810-edbe-11ec-82d1-11348ecbf4a6
data:
- id: 10024
name: Improvement
- id: 10006
name: Task
- id: 10007
name: Sub-task
- id: 10025
name: New Feature
- id: 10023
name: Bug
- id: 10000
name: Epic
status: ok

View file

@ -0,0 +1,5 @@
summary: Run a server log connector.
value:
params:
level: warn
message: Test warning message.

View file

@ -0,0 +1,4 @@
summary: Response from running a server log connector.
value:
connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907
status: ok

View file

@ -0,0 +1,8 @@
summary: Run a ServiceNow ITOM connector to retrieve the list of choices.
value:
params:
subAction: getChoices
subActionParams:
fields:
- severity
- urgency

View file

@ -0,0 +1,41 @@
summary: Response from retrieving the list of choices for a ServiceNow ITOM connector.
value:
connector_id: 9d9be270-2fd2-11ed-b0e0-87533c532698
data:
- dependent_value: ""
element: severity
label: Critical
value: 1
- dependent_value: ""
element: severity
label: Major
value: 2
- dependent_value: ""
element: severity
label: Minor
value: 3
- dependent_value: ""
element: severity
label: Warning
value: 4
- dependent_value: ""
element: severity
label: OK
value: 5
- dependent_value: ""
element: severity
label: Clear
value: 0
- dependent_value: ""
element: urgency
label: 1 - High
value: 1
- dependent_value: ""
element: urgency
label: 2 - Medium
value: 2
- dependent_value: ""
element: urgency
label: 3 - Low
value: 3
status: ok

View file

@ -0,0 +1,12 @@
summary: Run a Swimlane connector to create an incident.
value:
params:
subAction: pushToService
subActionParams:
comments:
- commentId: 1
comment: A comment about the incident.
incident:
caseId: "1000"
caseName: Case name
description: Description of the incident.

View file

@ -0,0 +1,12 @@
summary: Response from creating a Swimlane incident.
value:
connector_id: a4746470-2f94-11ed-b0e0-87533c532698
data:
id: aKPmBHWzmdRQtx6Mx
title: TEST-457
url: https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx
pushedDate: 2022-09-08T16:52:27.866Z
comments:
- commentId: 1
pushedDate: 2022-09-08T16:52:27.865Z
status: ok

View file

@ -0,0 +1,15 @@
type: object
title: Unsuccessful rule API response
properties:
error:
type: string
example: Unauthorized
enum:
- Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
enum:
- 401

View file

@ -0,0 +1,15 @@
type: object
properties:
error:
type: string
example: Not Found
enum:
- Not Found
message:
type: string
example: "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
statusCode:
type: integer
example: 404
enum:
- 404

View file

@ -0,0 +1,13 @@
title: Index connector parameters
description: Test an action that indexes a document into Elasticsearch.
type: object
required:
- documents
properties:
documents:
type: array
description: The documents in JSON format for index connectors.
items:
type: object
additionalProperties: true

View file

@ -0,0 +1,20 @@
title: Server log connector parameters
description: Test an action that writes an entry to the Kibana server log.
type: object
required:
- message
properties:
level:
type: string
description: The log level of the message for server log connectors.
enum:
- debug
- error
- fatal
- info
- trace
- warn
default: info
message:
type: string
description: The message for server log connectors.

View file

@ -0,0 +1,49 @@
title: The addEvent subaction
type: object
required:
- subAction
description: The `addEvent` subaction for ServiceNow ITOM connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- addEvent
subActionParams:
type: object
description: The set of configuration properties for the action.
properties:
additional_info:
type: string
description: Additional information about the event.
description:
type: string
description: The details about the event.
event_class:
type: string
description: A specific instance of the source.
message_key:
type: string
description: All actions sharing this key are associated with the same ServiceNow alert. The default value is `<rule ID>:<alert instance ID>`.
metric_name:
type: string
description: The name of the metric.
node:
type: string
description: The host that the event was triggered for.
resource:
type: string
description: The name of the resource.
severity:
type: string
description: The severity of the event.
source:
type: string
description: The name of the event source type.
time_of_event:
type: string
description: The time of the event.
type:
type: string
description: The type of event.

View file

@ -0,0 +1,30 @@
title: The closeAlert subaction
type: object
required:
- subAction
- subActionParams
description: The `closeAlert` subaction for Opsgenie connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- closeAlert
subActionParams:
type: object
required:
- alias
properties:
alias:
type: string
description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
note:
type: string
description: Additional information for the alert.
source:
type: string
description: The display name for the source of the alert.
user:
type: string
description: The display name for the owner.

View file

@ -0,0 +1,112 @@
title: The createAlert subaction
type: object
required:
- subAction
- subActionParams
description: The `createAlert` subaction for Opsgenie connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- createAlert
subActionParams:
type: object
required:
- message
properties:
actions:
type: array
description: The custom actions available to the alert.
items:
type: string
alias:
type: string
description: The unique identifier used for alert deduplication in Opsgenie.
description:
type: string
description: A description that provides detailed information about the alert.
details:
type: object
description: The custom properties of the alert.
additionalProperties: true
example: {"key1":"value1","key2":"value2"}
entity:
type: string
description: The domain of the alert. For example, the application or server name.
message:
type: string
description: The alert message.
note:
type: string
description: Additional information for the alert.
priority:
type: string
description: The priority level for the alert.
enum:
- P1
- P2
- P3
- P4
- P5
responders:
type: array
description: >
The entities to receive notifications about the alert.
If `type` is `user`, either `id` or `username` is required.
If `type` is `team`, either `id` or `name` is required.
items:
type: object
properties:
id:
type: string
description: The identifier for the entity.
name:
type: string
description: The name of the entity.
type:
type: string
description: The type of responders, in this case `escalation`.
enum:
- escalation
- schedule
- team
- user
username:
type: string
description: A valid email address for the user.
source:
type: string
description: The display name for the source of the alert.
tags:
type: array
description: The tags for the alert.
items:
type: string
user:
type: string
description: The display name for the owner.
visibleTo:
type: array
description: The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required.
items:
type: object
required:
- type
properties:
id:
type: string
description: The identifier for the entity.
name:
type: string
description: The name of the entity.
type:
type: string
description: Valid values are `team` and `user`.
enum:
- team
- user
username:
type: string
description: The user name. This property is required only when the `type` is `user`.

View file

@ -0,0 +1,22 @@
title: The fieldsByIssueType subaction
type: object
required:
- subAction
- subActionParams
description: The `fieldsByIssueType` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- fieldsByIssueType
subActionParams:
type: object
required:
- id
properties:
id:
type: string
description: The Jira issue type identifier.
example: 10024

View file

@ -0,0 +1,23 @@
title: The getChoices subaction
type: object
required:
- subAction
- subActionParams
description: The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getChoices
subActionParams:
type: object
description: The set of configuration properties for the action.
required:
- fields
properties:
fields:
type: array
description: An array of fields.
items:
type: string

View file

@ -0,0 +1,11 @@
title: The getFields subaction
type: object
required:
- subAction
description: The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getFields

View file

@ -0,0 +1,21 @@
title: The getIncident subaction
type: object
description: The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
required:
- subAction
- subActionParams
properties:
subAction:
type: string
description: The action to test.
enum:
- getIncident
subActionParams:
type: object
required:
- externalId
properties:
externalId:
type: string
description: The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
example: 71778

View file

@ -0,0 +1,20 @@
title: The issue subaction
type: object
required:
- subAction
description: The `issue` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- issue
subActionParams:
type: object
required:
- id
properties:
id:
type: string
description: The Jira issue identifier.
example: 71778

View file

@ -0,0 +1,20 @@
title: The issues subaction
type: object
required:
- subAction
- subActionParams
description: The `issues` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- issues
subActionParams:
type: object
required:
- title
properties:
title:
type: string
description: The title of the Jira issue.

View file

@ -0,0 +1,11 @@
title: The issueTypes subaction
type: object
required:
- subAction
description: The `issueTypes` subaction for Jira connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- issueTypes

View file

@ -0,0 +1,133 @@
title: The pushToService subaction
type: object
required:
- subAction
- subActionParams
description: The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- pushToService
subActionParams:
type: object
description: The set of configuration properties for the action.
properties:
comments:
type: array
description: Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane.
items:
type: object
properties:
comment:
type: string
description: A comment related to the incident. For example, describe how to troubleshoot the issue.
commentId:
type: integer
description: A unique identifier for the comment.
incident:
type: object
description: Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.
properties:
alertId:
type: string
description: The alert identifier for Swimlane connectors.
caseId:
type: string
description: The case identifier for the incident for Swimlane connectors.
caseName:
type: string
description: The case name for the incident for Swimlane connectors.
category:
type: string
description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_display:
type: string
description: A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_id:
type: string
description: >
The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters.
NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.
description:
type: string
description: The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
dest_ip:
description: >
A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
externalId:
type: string
description: >
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
If present, the incident is updated. Otherwise, a new incident is created.
impact:
type: string
description: The impact of the incident for ServiceNow ITSM connectors.
issueType:
type: integer
description: The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`.
labels:
type: array
items:
type: string
description: >
The labels for the incident for Jira connectors.
NOTE: Labels cannot contain spaces.
malware_hash:
description: A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
malware_url:
type: string
description: A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
parent:
type: string
description: The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues.
priority:
type: string
description: The priority of the incident in Jira and ServiceNow SecOps connectors.
ruleName:
type: string
description: The rule name for Swimlane connectors.
severity:
type: string
description: The severity of the incident for ServiceNow ITSM and Swimlane connectors.
short_description:
type: string
description: >
A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
source_ip:
description: A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
oneOf:
- type: string
- type: array
items:
type: string
subcategory:
type: string
description: The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
summary:
type: string
description: A summary of the incident for Jira connectors.
title:
type: string
description: >
A title for the incident for Jira connectors.
It is used for searching the contents of the knowledge base.
urgency:
type: string
description: The urgency of the incident for ServiceNow ITSM connectors.

View file

@ -23,18 +23,17 @@ paths:
$ref: paths/s@{spaceid}@api@actions@connectors.yaml
'/s/{spaceId}/api/actions/connector_types':
$ref: paths/s@{spaceid}@api@actions@connector_types.yaml
# '/s/{spaceId}/api/actions/connector/{connectorId}/_execute':
# $ref: paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml
'/s/{spaceId}/api/actions/connector/{connectorId}/_execute':
$ref: paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml
# Deprecated endpoints:
# '/s/{spaceId}/api/actions/action/{actionId}':
# $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}.yaml'
# '/s/{spaceId}/api/actions':
# $ref: 'paths/s@{spaceid}@api@actions.yaml'
# '/s/{spaceId}/api/actions/list_action_types':
# '/s/{spaceId}/api/actions/list_action_types':
# $ref: 'paths/s@{spaceid}@api@actions@list_action_types.yaml'
# '/s/{spaceId}/api/actions/action':
# $ref: 'paths/s@{spaceid}@api@actions@action.yaml'
# '/s/{spaceId}/api/actions/action/{actionId}':
# $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}.yaml'
# '/s/{spaceId}/api/actions/action/{actionId}/_execute':
# $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}@_execute.yaml'
components:

View file

@ -6,7 +6,7 @@ post:
tags:
- connectors
parameters:
- $ref: ../components/headers/kbn_xsrf.yaml
- $ref: '../components/headers/kbn_xsrf.yaml'
- $ref: '../components/parameters/space_id.yaml'
requestBody:
required: true
@ -53,16 +53,7 @@ post:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '../components/schemas/401_response.yaml'
servers:
- url: https://localhost:5601
servers:

View file

@ -23,16 +23,7 @@ get:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '../components/schemas/401_response.yaml'
'404':
description: Object is not found.
content:
@ -61,7 +52,7 @@ delete:
tags:
- connectors
parameters:
- $ref: ../components/headers/kbn_xsrf.yaml
- $ref: '../components/headers/kbn_xsrf.yaml'
- $ref: '../components/parameters/connector_id.yaml'
- $ref: '../components/parameters/space_id.yaml'
responses:
@ -72,16 +63,7 @@ delete:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '../components/schemas/401_response.yaml'
'404':
description: Object is not found.
content:
@ -109,7 +91,7 @@ put:
tags:
- connectors
parameters:
- $ref: ../components/headers/kbn_xsrf.yaml
- $ref: '../components/headers/kbn_xsrf.yaml'
- $ref: '../components/parameters/connector_id.yaml'
- $ref: '../components/parameters/space_id.yaml'
requestBody:
@ -167,32 +149,13 @@ put:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '../components/schemas/401_response.yaml'
'404':
description: Object is not found.
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Not Found
message:
type: string
example: "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
statusCode:
type: integer
example: 404
$ref: '../components/schemas/404_response.yaml'
servers:
- url: https://localhost:5601
servers:

View file

@ -0,0 +1,105 @@
post:
summary: Runs a connector.
operationId: runConnector
description: >
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.
tags:
- connectors
parameters:
- $ref: '../components/headers/kbn_xsrf.yaml'
- $ref: '../components/parameters/connector_id.yaml'
- $ref: '../components/parameters/space_id.yaml'
requestBody:
required: true
content:
application/json:
schema:
title: Run connector request body properties
description: The properties vary depending on the connector type.
type: object
required:
- params
properties:
params:
oneOf:
- $ref: '../components/schemas/run_connector_params_documents.yaml'
- $ref: '../components/schemas/run_connector_params_level_message.yaml'
- title: Subaction parameters
description: Test an action that involves a subaction.
oneOf:
- $ref: '../components/schemas/run_connector_subaction_addevent.yaml'
- $ref: '../components/schemas/run_connector_subaction_closealert.yaml'
- $ref: '../components/schemas/run_connector_subaction_createalert.yaml'
- $ref: '../components/schemas/run_connector_subaction_fieldsbyissuetype.yaml'
- $ref: '../components/schemas/run_connector_subaction_getchoices.yaml'
- $ref: '../components/schemas/run_connector_subaction_getfields.yaml'
- $ref: '../components/schemas/run_connector_subaction_getincident.yaml'
- $ref: '../components/schemas/run_connector_subaction_issue.yaml'
- $ref: '../components/schemas/run_connector_subaction_issues.yaml'
- $ref: '../components/schemas/run_connector_subaction_issuetypes.yaml'
- $ref: '../components/schemas/run_connector_subaction_pushtoservice.yaml'
discriminator:
propertyName: subAction
examples:
runIndexConnectorRequest:
$ref: '../components/examples/run_index_connector_request.yaml'
runJiraConnectorRequest:
$ref: '../components/examples/run_jira_connector_request.yaml'
runServerLogConnectorRequest:
$ref: '../components/examples/run_server_log_connector_request.yaml'
runServiceNowITOMConnectorRequest:
$ref: '../components/examples/run_servicenow_itom_connector_request.yaml'
runSwimlaneConnectorRequest:
$ref: '../components/examples/run_swimlane_connector_request.yaml'
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
required:
- connector_id
- status
properties:
connector_id:
type: string
description: The identifier for the connector.
data:
oneOf:
- type: object
description: Information returned from the action.
additionalProperties: true
- type: array
description: An array of information returned from the action.
items:
type: object
status:
type: string
description: The status of the action.
enum:
- error
- ok
examples:
runIndexConnectorResponse:
$ref: '../components/examples/run_index_connector_response.yaml'
runJiraConnectorResponse:
$ref: '../components/examples/run_jira_connector_response.yaml'
runServerLogConnectorResponse:
$ref: '../components/examples/run_server_log_connector_response.yaml'
runServiceNowITOMConnectorResponse:
$ref: '../components/examples/run_servicenow_itom_connector_response.yaml'
runSwimlaneConnectorResponse:
$ref: '../components/examples/run_swimlane_connector_response.yaml'
'401':
description: Authorization information is missing or invalid.
content:
application/json:
schema:
$ref: '../components/schemas/401_response.yaml'
servers:
- url: https://localhost:5601
servers:
- url: https://localhost:5601

View file

@ -63,16 +63,7 @@ get:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '../components/schemas/401_response.yaml'
servers:
- url: https://localhost:5601
servers:

View file

@ -60,16 +60,7 @@ get:
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
$ref: '../components/schemas/401_response.yaml'
servers:
- url: https://localhost:5601
servers: