mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 01:38:56 -04:00
# Backport This will backport the following commits from `main` to `8.16`: - [[Detection Engine][Docs] Updating examples to meet old ascii docs (#207558)](https://github.com/elastic/kibana/pull/207558) <!--- Backport version: 9.6.4 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Yara Tercero","email":"yctercero@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-02-05T07:02:48Z","message":"[Detection Engine][Docs] Updating examples to meet old ascii docs (#207558)\n\n# Summary\r\n\r\nAs part of the effort to add missing content for Security APIs, this PR\r\nintroduces a few missing request, response, and parameter examples for\r\nDetection Engine Alert and migration APIs.","sha":"d4199dcac1f0bff5f3511e79a860c77534b35c74","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detection Engine","v8.16.0","backport:version","v8.17.0","v8.18.0","v9.1.0"],"title":"[Detection Engine][Docs] Updating examples to meet old ascii docs","number":207558,"url":"https://github.com/elastic/kibana/pull/207558","mergeCommit":{"message":"[Detection Engine][Docs] Updating examples to meet old ascii docs (#207558)\n\n# Summary\r\n\r\nAs part of the effort to add missing content for Security APIs, this PR\r\nintroduces a few missing request, response, and parameter examples for\r\nDetection Engine Alert and migration APIs.","sha":"d4199dcac1f0bff5f3511e79a860c77534b35c74"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.16","8.17","8.18"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/207558","number":207558,"mergeCommit":{"message":"[Detection Engine][Docs] Updating examples to meet old ascii docs (#207558)\n\n# Summary\r\n\r\nAs part of the effort to add missing content for Security APIs, this PR\r\nintroduces a few missing request, response, and parameter examples for\r\nDetection Engine Alert and migration APIs.","sha":"d4199dcac1f0bff5f3511e79a860c77534b35c74"}}]}] BACKPORT-->
This commit is contained in:
Yara Tercero
GitHub
parent
9da88fb81d
commit
90b568b81a
26 changed files with 59433 additions and 89 deletions
58093
oas_docs/output/kibana.serverless.yaml
Normal file
58093
oas_docs/output/kibana.serverless.yaml
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -8146,6 +8146,11 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
index_mapping_outdated: false
|
||||
name: .alerts-security.alerts-default
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -8238,6 +8243,42 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
application: {}
|
||||
cluster:
|
||||
all: true
|
||||
manage: true
|
||||
manage_api_key: true
|
||||
manage_index_templates: true
|
||||
manage_ml: true
|
||||
manage_own_api_key: true
|
||||
manage_pipeline: true
|
||||
manage_security: true
|
||||
manage_transform: true
|
||||
monitor: true
|
||||
monitor_ml: true
|
||||
monitor_transform: true
|
||||
has_all_requested: true
|
||||
has_encryption_key: true
|
||||
index:
|
||||
.alerts-security.alerts-default:
|
||||
all: true
|
||||
create: true
|
||||
create_doc: true
|
||||
create_index: true
|
||||
delete: true
|
||||
delete_index: true
|
||||
index: true
|
||||
maintenance: true
|
||||
manage: true
|
||||
monitor: true
|
||||
read: true
|
||||
view_index_metadata: true
|
||||
write: true
|
||||
is_authenticated: true
|
||||
username: elastic
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -9062,6 +9103,23 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
assignees:
|
||||
add:
|
||||
- u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
|
||||
remove: []
|
||||
ids:
|
||||
- 681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
|
||||
remove:
|
||||
value:
|
||||
assignees:
|
||||
add: []
|
||||
remove:
|
||||
- u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
|
||||
ids:
|
||||
- 681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -9070,13 +9128,32 @@ paths:
|
|||
description: Details about the assignees to assign and unassign.
|
||||
ids:
|
||||
$ref: '#/components/schemas/Security_Detections_API_AlertIds'
|
||||
description: List of alerts ids to assign and unassign passed assignees.
|
||||
required:
|
||||
- assignees
|
||||
- ids
|
||||
required: true
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/ndjson; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
batches: 1,
|
||||
deleted: 0,
|
||||
failures: []
|
||||
noops: 0,
|
||||
requests_per_second: '-1,'
|
||||
retries:
|
||||
- bulk: 0,
|
||||
- search: 0
|
||||
throttled_millis: 0,
|
||||
throttled_until_millis: 0,
|
||||
timed_out: false,
|
||||
took: 76,
|
||||
total: 1,
|
||||
updated: 1,
|
||||
version_conflicts: 0,
|
||||
description: Indicates a successful call.
|
||||
'400':
|
||||
description: Invalid request.
|
||||
|
|
@ -9094,9 +9171,13 @@ paths:
|
|||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
schema:
|
||||
example:
|
||||
migration_ids:
|
||||
- 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
type: object
|
||||
properties:
|
||||
migration_ids:
|
||||
description: Array of `migration_id`s to finalize.
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
|
|
@ -9109,6 +9190,17 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
migrations:
|
||||
- completed: true
|
||||
destinationIndex: .siem-signals-default-000002-r000016
|
||||
id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
sourceIndex: .siem-signals-default-000002
|
||||
status: success
|
||||
updated: '2021-01-06T22:05:56.859Z'
|
||||
version: 16
|
||||
schema:
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_MigrationFinalizationResult'
|
||||
|
|
@ -9152,9 +9244,13 @@ paths:
|
|||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
schema:
|
||||
example:
|
||||
migration_ids:
|
||||
- 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
type: object
|
||||
properties:
|
||||
migration_ids:
|
||||
description: Array of `migration_id`s to cleanup.
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
|
|
@ -9167,6 +9263,16 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
migrations:
|
||||
- destinationIndex: .siem-signals-default-000002-r000016
|
||||
id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
sourceIndex: .siem-signals-default-000002
|
||||
status: success
|
||||
updated: '2021-01-06T22:05:56.859Z'
|
||||
version: 16
|
||||
schema:
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_MigrationCleanupResult'
|
||||
|
|
@ -9203,13 +9309,21 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
singleIndex:
|
||||
value:
|
||||
index:
|
||||
- .siem-signals-default-000001
|
||||
schema:
|
||||
allOf:
|
||||
- type: object
|
||||
properties:
|
||||
index:
|
||||
description: Array of index names to migrate.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
|
|
@ -9221,6 +9335,13 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
indices:
|
||||
- index: .siem-signals-default-000001,
|
||||
migration_id: 923f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
migration_index: .siem-signals-default-000001-r000016
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -9258,7 +9379,7 @@ paths:
|
|||
tags:
|
||||
- Security Detections API
|
||||
/api/detection_engine/signals/migration_status:
|
||||
post:
|
||||
get:
|
||||
description: Retrieve indices that contain detection alerts of a particular age, along with migration information for each of those indices.
|
||||
operationId: ReadAlertsMigrationStatus
|
||||
parameters:
|
||||
|
|
@ -9270,12 +9391,37 @@ paths:
|
|||
description: |
|
||||
Time from which data is analyzed. For example, now-4200s means the rule analyzes data from 70 minutes
|
||||
before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).
|
||||
example: now-30d
|
||||
format: date-math
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
indices:
|
||||
- index: .siem-signals-default-000002
|
||||
is_outdated: true
|
||||
migrations:
|
||||
- id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
status: pending
|
||||
updated: '2021-01-06T20:41:37.173Z'
|
||||
version: 16
|
||||
signal_versions:
|
||||
- count: 100
|
||||
version: 15
|
||||
- count: 87
|
||||
version: 16
|
||||
version: 15
|
||||
- index: .siem-signals-default-000003
|
||||
is_outdated: false
|
||||
migrations: []
|
||||
signal_versions:
|
||||
- count: 54
|
||||
version: 16
|
||||
version: 16
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -9316,6 +9462,35 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
query:
|
||||
value:
|
||||
aggs:
|
||||
alertsByGrouping:
|
||||
terms:
|
||||
field: host.name
|
||||
size: 10
|
||||
missingFields:
|
||||
missing:
|
||||
field: host.name
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- bool:
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
must: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
- range:
|
||||
'@timestamp':
|
||||
gte: '2025-01-17T08:00:00.000Z'
|
||||
lte: '2025-01-18T07:59:59.999Z'
|
||||
runtime_mappings: {}
|
||||
size: 0
|
||||
schema:
|
||||
description: Elasticsearch query and aggregation request
|
||||
type: object
|
||||
|
|
@ -9353,6 +9528,31 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
_shards:
|
||||
failed: 0
|
||||
skipped: 0
|
||||
successful: 1
|
||||
total: 1
|
||||
aggregations:
|
||||
alertsByGrouping:
|
||||
buckets:
|
||||
- doc_count: 5
|
||||
key: Host-f43kkddfyc
|
||||
doc_count_error_upper_bound: 0
|
||||
sum_other_doc_count: 0
|
||||
missingFields:
|
||||
doc_count: 0
|
||||
hits:
|
||||
hits: []
|
||||
max_score: null
|
||||
total:
|
||||
relation: eq
|
||||
value: 5
|
||||
timed_out: false
|
||||
took: 0
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch search response
|
||||
|
|
@ -9388,6 +9588,43 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
signal_ids:
|
||||
- 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
|
||||
status: closed
|
||||
byQuery:
|
||||
value:
|
||||
conflicts: proceed
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- '@timestamp':
|
||||
format: strict_date_optional_time
|
||||
gte: '2024-10-23T07:00:00.000Z'
|
||||
lte: '2025-01-21T20:12:11.704Z'
|
||||
range: null
|
||||
- bool:
|
||||
filter:
|
||||
bool:
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
- '@timestamp':
|
||||
format: strict_date_optional_time
|
||||
gte: '2024-10-23T07:00:00.000Z'
|
||||
lte: '2025-01-21T20:12:11.704Z'
|
||||
range: null
|
||||
must: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
must: []
|
||||
must_not: []
|
||||
should: []
|
||||
status: closed
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByIds'
|
||||
|
|
@ -9398,6 +9635,41 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
batches: 1
|
||||
deleted: 0
|
||||
failures: []
|
||||
noops: 0
|
||||
requests_per_second: -1
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
throttled_until_millis: 0
|
||||
timed_out: false
|
||||
took: 81
|
||||
total: 1
|
||||
updated: 1
|
||||
version_conflicts: 0
|
||||
byQuery:
|
||||
value:
|
||||
batches: 1
|
||||
deleted: 0
|
||||
failures: []
|
||||
noops: 0
|
||||
requests_per_second: -1
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
throttled_until_millis: 0
|
||||
timed_out: false
|
||||
took: 100
|
||||
total: 17
|
||||
updated: 17
|
||||
version_conflicts: 0
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
|
|
@ -9436,6 +9708,23 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
ids:
|
||||
- 549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
|
||||
tags:
|
||||
tags_to_add:
|
||||
- Duplicate
|
||||
tags_to_remove: []
|
||||
remove:
|
||||
value:
|
||||
ids:
|
||||
- 549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
|
||||
tags:
|
||||
tags_to_add: []
|
||||
tags_to_remove:
|
||||
- Duplicate
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -9452,6 +9741,24 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json; Elastic-Api-Version=2023-10-31:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
batches: 1,
|
||||
deleted: 0,
|
||||
failures: []
|
||||
noops: 0,
|
||||
requests_per_second: '-1,'
|
||||
retries:
|
||||
bulk: 0,
|
||||
search: 0
|
||||
throttled_millis: 0,
|
||||
throttled_until_millis: 0,
|
||||
timed_out: false,
|
||||
took: 68,
|
||||
total: 1,
|
||||
updated: 1,
|
||||
version_conflicts: 0,
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
|
|
@ -31664,22 +31971,28 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
add:
|
||||
description: A list of users ids to assign.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
|
||||
description: A list of users ids to assign.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
type: array
|
||||
remove:
|
||||
description: A list of users ids to unassign.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
|
||||
description: A list of users ids to unassign.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- add
|
||||
- remove
|
||||
Security_Detections_API_AlertIds:
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
Security_Detections_API_AlertsIndex:
|
||||
|
|
@ -31724,12 +32037,15 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
requests_per_second:
|
||||
description: The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API.
|
||||
minimum: 1
|
||||
type: integer
|
||||
size:
|
||||
description: Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API.
|
||||
minimum: 1
|
||||
type: integer
|
||||
slices:
|
||||
description: The number of subtasks for the migration task. Corresponds to slices on the Reindex API.
|
||||
minimum: 1
|
||||
type: integer
|
||||
Security_Detections_API_AlertsSort:
|
||||
|
|
@ -31744,6 +32060,7 @@ components:
|
|||
- additionalProperties: true
|
||||
type: object
|
||||
Security_Detections_API_AlertStatus:
|
||||
description: The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.
|
||||
enum:
|
||||
- open
|
||||
- closed
|
||||
|
|
@ -31792,8 +32109,12 @@ components:
|
|||
- suppress
|
||||
type: string
|
||||
Security_Detections_API_AlertTag:
|
||||
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
|
||||
description: Use alert tags to organize related alerts into categories that you can filter and group.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
Security_Detections_API_AlertTags:
|
||||
description: List of keywords to organize related alerts into categories that you can filter and group.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_AlertTag'
|
||||
type: array
|
||||
|
|
@ -35922,8 +36243,11 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
signal_ids:
|
||||
description: List of alert `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
status:
|
||||
|
|
@ -35949,6 +36273,7 @@ components:
|
|||
- query
|
||||
- status
|
||||
Security_Detections_API_SetAlertTags:
|
||||
description: Object with list of tags to add and remove.
|
||||
type: object
|
||||
properties:
|
||||
tags_to_add:
|
||||
|
|
@ -37658,9 +37983,11 @@ components:
|
|||
- crowdstrike
|
||||
type: string
|
||||
Security_Endpoint_Management_API_AlertIds:
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/Security_Endpoint_Management_API_NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
Security_Endpoint_Management_API_CaseIds:
|
||||
|
|
@ -37877,11 +38204,6 @@ components:
|
|||
type: string
|
||||
required:
|
||||
- hostStatuses
|
||||
Security_Endpoint_Management_API_NonEmptyString:
|
||||
description: A string that does not contain only whitespace characters
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
Security_Endpoint_Management_API_NoParametersRequestSchema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
|
|||
|
|
@ -15,20 +15,14 @@
|
|||
*/
|
||||
|
||||
import { z } from '@kbn/zod';
|
||||
import { isNonEmptyString } from '@kbn/zod-helpers';
|
||||
|
||||
import { AlertIds } from '../../model/alert.gen';
|
||||
import { NonEmptyString } from '../../model/primitives.gen';
|
||||
|
||||
export type AlertAssignees = z.infer<typeof AlertAssignees>;
|
||||
export const AlertAssignees = z.object({
|
||||
/**
|
||||
* A list of users ids to assign.
|
||||
*/
|
||||
add: z.array(NonEmptyString),
|
||||
/**
|
||||
* A list of users ids to unassign.
|
||||
*/
|
||||
remove: z.array(NonEmptyString),
|
||||
add: z.array(z.string().min(1).superRefine(isNonEmptyString)),
|
||||
remove: z.array(z.string().min(1).superRefine(isNonEmptyString)),
|
||||
});
|
||||
|
||||
export type SetAlertAssigneesRequestBody = z.infer<typeof SetAlertAssigneesRequestBody>;
|
||||
|
|
@ -37,9 +31,6 @@ export const SetAlertAssigneesRequestBody = z.object({
|
|||
* Details about the assignees to assign and unassign.
|
||||
*/
|
||||
assignees: AlertAssignees,
|
||||
/**
|
||||
* List of alerts ids to assign and unassign passed assignees.
|
||||
*/
|
||||
ids: AlertIds,
|
||||
});
|
||||
export type SetAlertAssigneesRequestBodyInput = z.input<typeof SetAlertAssigneesRequestBody>;
|
||||
|
|
|
|||
|
|
@ -28,10 +28,42 @@ paths:
|
|||
description: Details about the assignees to assign and unassign.
|
||||
ids:
|
||||
$ref: '../../model/alert.schema.yaml#/components/schemas/AlertIds'
|
||||
description: List of alerts ids to assign and unassign passed assignees.
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
assignees:
|
||||
add: ['u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0']
|
||||
remove: []
|
||||
ids: ['681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6']
|
||||
remove:
|
||||
value:
|
||||
assignees:
|
||||
add: []
|
||||
remove: ['u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0']
|
||||
ids: ['681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6']
|
||||
responses:
|
||||
200:
|
||||
description: Indicates a successful call.
|
||||
content:
|
||||
application/ndjson:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
took: 76,
|
||||
timed_out: false,
|
||||
total: 1,
|
||||
updated: 1,
|
||||
deleted: 0,
|
||||
batches: 1,
|
||||
version_conflicts: 0,
|
||||
noops: 0,
|
||||
retries:
|
||||
- bulk: 0,
|
||||
- search: 0
|
||||
throttled_millis: 0,
|
||||
requests_per_second: -1,
|
||||
throttled_until_millis: 0,
|
||||
failures: []
|
||||
400:
|
||||
description: Invalid request.
|
||||
|
||||
|
|
@ -46,10 +78,14 @@ components:
|
|||
add:
|
||||
type: array
|
||||
items:
|
||||
$ref: '../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
|
||||
description: A list of users ids to assign.
|
||||
type: string
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
description: A list of users ids to assign.
|
||||
remove:
|
||||
type: array
|
||||
items:
|
||||
$ref: '../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
|
||||
description: A list of users ids to unassign.
|
||||
type: string
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
description: A list of users ids to unassign.
|
||||
|
|
|
|||
|
|
@ -18,6 +18,9 @@ import { z } from '@kbn/zod';
|
|||
|
||||
import { AlertIds, AlertTags } from '../../../model/alert.gen';
|
||||
|
||||
/**
|
||||
* Object with list of tags to add and remove.
|
||||
*/
|
||||
export type SetAlertTags = z.infer<typeof SetAlertTags>;
|
||||
export const SetAlertTags = z.object({
|
||||
tags_to_add: AlertTags,
|
||||
|
|
|
|||
|
|
@ -30,6 +30,19 @@ paths:
|
|||
required:
|
||||
- ids
|
||||
- tags
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
tags:
|
||||
tags_to_add: ['Duplicate']
|
||||
tags_to_remove: []
|
||||
ids: ['549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e']
|
||||
remove:
|
||||
value:
|
||||
tags:
|
||||
tags_to_add: []
|
||||
tags_to_remove: ['Duplicate']
|
||||
ids: ['549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e']
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -39,6 +52,24 @@ paths:
|
|||
type: object
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
took: 68,
|
||||
timed_out: false,
|
||||
total: 1,
|
||||
updated: 1,
|
||||
deleted: 0,
|
||||
batches: 1,
|
||||
version_conflicts: 0,
|
||||
noops: 0,
|
||||
retries:
|
||||
bulk: 0,
|
||||
search: 0
|
||||
throttled_millis: 0,
|
||||
requests_per_second: -1,
|
||||
throttled_until_millis: 0,
|
||||
failures: []
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
@ -63,6 +94,7 @@ paths:
|
|||
components:
|
||||
schemas:
|
||||
SetAlertTags:
|
||||
description: Object with list of tags to add and remove.
|
||||
type: object
|
||||
properties:
|
||||
tags_to_add:
|
||||
|
|
|
|||
|
|
@ -25,6 +25,11 @@ paths:
|
|||
type: boolean
|
||||
nullable: true
|
||||
required: [name, index_mapping_outdated]
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
index_mapping_outdated: false
|
||||
name: '.alerts-security.alerts-default'
|
||||
401:
|
||||
description: Unsuccessful authentication response
|
||||
content:
|
||||
|
|
|
|||
|
|
@ -29,6 +29,42 @@ paths:
|
|||
has_encryption_key:
|
||||
type: boolean
|
||||
required: [is_authenticated, has_encryption_key]
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
username: elastic
|
||||
has_all_requested: true
|
||||
cluster:
|
||||
all: true
|
||||
monitor_ml: true
|
||||
manage_transform: true
|
||||
manage_index_templates: true
|
||||
monitor_transform: true
|
||||
manage_ml: true
|
||||
monitor: true
|
||||
manage_pipeline: true
|
||||
manage_api_key: true
|
||||
manage_security: true
|
||||
manage_own_api_key: true
|
||||
manage: true
|
||||
index:
|
||||
.alerts-security.alerts-default:
|
||||
all: true
|
||||
create: true
|
||||
create_doc: true
|
||||
create_index: true
|
||||
delete: true
|
||||
delete_index: true
|
||||
index: true
|
||||
maintenance: true
|
||||
manage: true
|
||||
monitor: true
|
||||
read: true
|
||||
view_index_metadata: true
|
||||
write: true
|
||||
application: {}
|
||||
is_authenticated: true
|
||||
has_encryption_key: true
|
||||
401:
|
||||
description: Unsuccessful authentication response
|
||||
content:
|
||||
|
|
|
|||
|
|
@ -48,6 +48,35 @@ paths:
|
|||
sort:
|
||||
$ref: '#/components/schemas/AlertsSort'
|
||||
description: Elasticsearch query and aggregation request
|
||||
examples:
|
||||
query:
|
||||
value:
|
||||
size: 0
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- bool:
|
||||
must: []
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
should: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
- range:
|
||||
'@timestamp':
|
||||
gte: 2025-01-17T08:00:00.000Z
|
||||
lte: 2025-01-18T07:59:59.999Z
|
||||
aggs:
|
||||
alertsByGrouping:
|
||||
terms:
|
||||
field: host.name
|
||||
size: 10
|
||||
missingFields:
|
||||
missing:
|
||||
field: host.name
|
||||
runtime_mappings: {}
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -57,6 +86,31 @@ paths:
|
|||
type: object
|
||||
additionalProperties: true
|
||||
description: Elasticsearch search response
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
took: 0
|
||||
timed_out: false
|
||||
_shards:
|
||||
total: 1
|
||||
successful: 1
|
||||
skipped: 0
|
||||
failed: 0
|
||||
hits:
|
||||
total:
|
||||
value: 5
|
||||
relation: eq
|
||||
max_score: null
|
||||
hits: []
|
||||
aggregations:
|
||||
alertsByGrouping:
|
||||
doc_count_error_upper_bound: 0
|
||||
sum_other_doc_count: 0
|
||||
buckets:
|
||||
- key: Host-f43kkddfyc
|
||||
doc_count: 5
|
||||
missingFields:
|
||||
doc_count: 0
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
|
|||
|
|
@ -15,13 +15,16 @@
|
|||
*/
|
||||
|
||||
import { z } from '@kbn/zod';
|
||||
import { isNonEmptyString } from '@kbn/zod-helpers';
|
||||
|
||||
import { NonEmptyString } from '../../../model/primitives.gen';
|
||||
import { AlertStatus } from '../../../model/alert.gen';
|
||||
|
||||
export type SetAlertsStatusByIds = z.infer<typeof SetAlertsStatusByIds>;
|
||||
export const SetAlertsStatusByIds = z.object({
|
||||
signal_ids: z.array(NonEmptyString).min(1),
|
||||
/**
|
||||
* List of alert `id`s.
|
||||
*/
|
||||
signal_ids: z.array(z.string().min(1).superRefine(isNonEmptyString)).min(1),
|
||||
status: AlertStatus,
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -21,6 +21,42 @@ paths:
|
|||
oneOf:
|
||||
- $ref: '#/components/schemas/SetAlertsStatusByIds'
|
||||
- $ref: '#/components/schemas/SetAlertsStatusByQuery'
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
status: closed
|
||||
signal_ids: ['80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1']
|
||||
byQuery:
|
||||
value:
|
||||
conflicts: proceed
|
||||
status: closed
|
||||
query:
|
||||
bool:
|
||||
must: []
|
||||
filter:
|
||||
- range:
|
||||
'@timestamp':
|
||||
gte: 2024-10-23T07:00:00.000Z
|
||||
lte: 2025-01-21T20:12:11.704Z
|
||||
format: strict_date_optional_time
|
||||
- bool:
|
||||
filter:
|
||||
bool:
|
||||
must: []
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
- range:
|
||||
'@timestamp':
|
||||
gte: 2024-10-23T07:00:00.000Z
|
||||
lte: 2025-01-21T20:12:11.704Z
|
||||
format: strict_date_optional_time
|
||||
should: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
must_not: []
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -30,6 +66,41 @@ paths:
|
|||
type: object
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
took: 81
|
||||
timed_out: false
|
||||
total: 1
|
||||
updated: 1
|
||||
deleted: 0
|
||||
batches: 1
|
||||
version_conflicts: 0
|
||||
noops: 0
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
requests_per_second: -1
|
||||
throttled_until_millis: 0
|
||||
failures: []
|
||||
byQuery:
|
||||
value:
|
||||
took: 100
|
||||
timed_out: false
|
||||
total: 17
|
||||
updated: 17
|
||||
deleted: 0
|
||||
batches: 1
|
||||
version_conflicts: 0
|
||||
noops: 0
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
requests_per_second: -1
|
||||
throttled_until_millis: 0
|
||||
failures: []
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
@ -58,8 +129,11 @@ components:
|
|||
properties:
|
||||
signal_ids:
|
||||
type: array
|
||||
description: List of alert `id`s.
|
||||
items:
|
||||
$ref: '../../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
|
||||
type: string
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
minItems: 1
|
||||
status:
|
||||
$ref: '../../../model/alert.schema.yaml#/components/schemas/AlertStatus'
|
||||
|
|
|
|||
|
|
@ -15,13 +15,21 @@
|
|||
*/
|
||||
|
||||
import { z } from '@kbn/zod';
|
||||
|
||||
import { NonEmptyString } from '../../../model/primitives.gen';
|
||||
import { isNonEmptyString } from '@kbn/zod-helpers';
|
||||
|
||||
export type AlertsReindexOptions = z.infer<typeof AlertsReindexOptions>;
|
||||
export const AlertsReindexOptions = z.object({
|
||||
/**
|
||||
* The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API.
|
||||
*/
|
||||
requests_per_second: z.number().int().min(1).optional(),
|
||||
/**
|
||||
* Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API.
|
||||
*/
|
||||
size: z.number().int().min(1).optional(),
|
||||
/**
|
||||
* The number of subtasks for the migration task. Corresponds to slices on the Reindex API.
|
||||
*/
|
||||
slices: z.number().int().min(1).optional(),
|
||||
});
|
||||
|
||||
|
|
@ -49,7 +57,10 @@ export const SkippedAlertsIndexMigration = z.object({
|
|||
export type CreateAlertsMigrationRequestBody = z.infer<typeof CreateAlertsMigrationRequestBody>;
|
||||
export const CreateAlertsMigrationRequestBody = z
|
||||
.object({
|
||||
index: z.array(NonEmptyString).min(1),
|
||||
/**
|
||||
* Array of index names to migrate.
|
||||
*/
|
||||
index: z.array(z.string().min(1).superRefine(isNonEmptyString)).min(1),
|
||||
})
|
||||
.merge(AlertsReindexOptions);
|
||||
export type CreateAlertsMigrationRequestBodyInput = z.input<
|
||||
|
|
|
|||
|
|
@ -24,13 +24,19 @@ paths:
|
|||
- type: object
|
||||
properties:
|
||||
index:
|
||||
description: Array of index names to migrate.
|
||||
type: array
|
||||
items:
|
||||
$ref: '../../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
|
||||
type: string
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
minItems: 1
|
||||
required: [index]
|
||||
- $ref: '#/components/schemas/AlertsReindexOptions'
|
||||
|
||||
examples:
|
||||
singleIndex:
|
||||
value:
|
||||
index: [.siem-signals-default-000001]
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -47,6 +53,13 @@ paths:
|
|||
- $ref: '#/components/schemas/AlertsIndexMigrationError'
|
||||
- $ref: '#/components/schemas/SkippedAlertsIndexMigration'
|
||||
required: [indices]
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
indices:
|
||||
- index: .siem-signals-default-000001,
|
||||
migration_id: 923f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
migration_index: .siem-signals-default-000001-r000016
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
@ -76,12 +89,15 @@ components:
|
|||
requests_per_second:
|
||||
type: integer
|
||||
minimum: 1
|
||||
description: The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API.
|
||||
size:
|
||||
type: integer
|
||||
minimum: 1
|
||||
description: Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API.
|
||||
slices:
|
||||
type: integer
|
||||
minimum: 1
|
||||
description: The number of subtasks for the migration task. Corresponds to slices on the Reindex API.
|
||||
|
||||
AlertsIndexMigrationSuccess:
|
||||
type: object
|
||||
|
|
|
|||
|
|
@ -34,6 +34,9 @@ export const MigrationCleanupResult = z.object({
|
|||
|
||||
export type AlertsMigrationCleanupRequestBody = z.infer<typeof AlertsMigrationCleanupRequestBody>;
|
||||
export const AlertsMigrationCleanupRequestBody = z.object({
|
||||
/**
|
||||
* Array of `migration_id`s to cleanup.
|
||||
*/
|
||||
migration_ids: z.array(z.string()).min(1),
|
||||
});
|
||||
export type AlertsMigrationCleanupRequestBodyInput = z.input<
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ paths:
|
|||
Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of
|
||||
the migration process. A successful migration will result in both the old and new indices being present.
|
||||
As such, the old, orphaned index can (and likely should) be deleted.
|
||||
|
||||
|
||||
While you can delete these indices manually,
|
||||
the endpoint accomplishes this task by applying a deletion policy to the relevant index, causing it to be deleted
|
||||
after 30 days. It also deletes other artifacts specific to the migration implementation.
|
||||
|
|
@ -28,11 +28,14 @@ paths:
|
|||
type: object
|
||||
properties:
|
||||
migration_ids:
|
||||
description: Array of `migration_id`s to cleanup.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
required: [migration_ids]
|
||||
example:
|
||||
migration_ids: [924f7c50-505f-11eb-ae0a-3fa2e626a51d]
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -42,6 +45,16 @@ paths:
|
|||
type: array
|
||||
items:
|
||||
$ref: '#/components/schemas/MigrationCleanupResult'
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
migrations:
|
||||
- id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
destinationIndex: .siem-signals-default-000002-r000016
|
||||
status: success
|
||||
sourceIndex: .siem-signals-default-000002
|
||||
version: 16
|
||||
updated: 2021-01-06T22:05:56.859Z
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
|
|||
|
|
@ -35,6 +35,9 @@ export const MigrationFinalizationResult = z.object({
|
|||
|
||||
export type FinalizeAlertsMigrationRequestBody = z.infer<typeof FinalizeAlertsMigrationRequestBody>;
|
||||
export const FinalizeAlertsMigrationRequestBody = z.object({
|
||||
/**
|
||||
* Array of `migration_id`s to finalize.
|
||||
*/
|
||||
migration_ids: z.array(z.string()).min(1),
|
||||
});
|
||||
export type FinalizeAlertsMigrationRequestBodyInput = z.input<
|
||||
|
|
|
|||
|
|
@ -24,11 +24,14 @@ paths:
|
|||
type: object
|
||||
properties:
|
||||
migration_ids:
|
||||
description: Array of `migration_id`s to finalize.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
required: [migration_ids]
|
||||
example:
|
||||
migration_ids: ['924f7c50-505f-11eb-ae0a-3fa2e626a51d']
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -38,6 +41,17 @@ paths:
|
|||
type: array
|
||||
items:
|
||||
$ref: '#/components/schemas/MigrationFinalizationResult'
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
migrations:
|
||||
- id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
completed: true
|
||||
destinationIndex: '.siem-signals-default-000002-r000016'
|
||||
status: success
|
||||
sourceIndex: '.siem-signals-default-000002'
|
||||
version: 16
|
||||
updated: '2021-01-06T22:05:56.859Z'
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ info:
|
|||
version: '2023-10-31'
|
||||
paths:
|
||||
/api/detection_engine/signals/migration_status:
|
||||
post:
|
||||
get:
|
||||
x-labels: [ess]
|
||||
operationId: ReadAlertsMigrationStatus
|
||||
x-codegen-enabled: true
|
||||
|
|
@ -23,6 +23,7 @@ paths:
|
|||
Time from which data is analyzed. For example, now-4200s means the rule analyzes data from 70 minutes
|
||||
before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).
|
||||
format: date-math
|
||||
example: now-30d
|
||||
responses:
|
||||
200:
|
||||
description: Successful response
|
||||
|
|
@ -36,6 +37,30 @@ paths:
|
|||
items:
|
||||
$ref: '#/components/schemas/IndexMigrationStatus'
|
||||
required: [indices]
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
indices:
|
||||
- index: .siem-signals-default-000002
|
||||
version: 15
|
||||
signal_versions:
|
||||
- version: 15
|
||||
count: 100
|
||||
- version: 16
|
||||
count: 87
|
||||
migrations:
|
||||
- id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
status: pending
|
||||
version: 16
|
||||
updated: 2021-01-06T20:41:37.173Z
|
||||
is_outdated: true
|
||||
- index: .siem-signals-default-000003
|
||||
version: 16
|
||||
signal_versions:
|
||||
- version: 16
|
||||
count: 54
|
||||
migrations: []
|
||||
is_outdated: false
|
||||
400:
|
||||
description: Invalid input data response
|
||||
content:
|
||||
|
|
|
|||
|
|
@ -15,21 +15,29 @@
|
|||
*/
|
||||
|
||||
import { z } from '@kbn/zod';
|
||||
|
||||
import { NonEmptyString } from './primitives.gen';
|
||||
import { isNonEmptyString } from '@kbn/zod-helpers';
|
||||
|
||||
/**
|
||||
* A list of alerts ids.
|
||||
* A list of alerts `id`s.
|
||||
*/
|
||||
export type AlertIds = z.infer<typeof AlertIds>;
|
||||
export const AlertIds = z.array(NonEmptyString).min(1);
|
||||
export const AlertIds = z.array(z.string().min(1).superRefine(isNonEmptyString)).min(1);
|
||||
|
||||
/**
|
||||
* Use alert tags to organize related alerts into categories that you can filter and group.
|
||||
*/
|
||||
export type AlertTag = z.infer<typeof AlertTag>;
|
||||
export const AlertTag = NonEmptyString;
|
||||
export const AlertTag = z.string().min(1).superRefine(isNonEmptyString);
|
||||
|
||||
/**
|
||||
* List of keywords to organize related alerts into categories that you can filter and group.
|
||||
*/
|
||||
export type AlertTags = z.infer<typeof AlertTags>;
|
||||
export const AlertTags = z.array(AlertTag);
|
||||
|
||||
/**
|
||||
* The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.
|
||||
*/
|
||||
export type AlertStatus = z.infer<typeof AlertStatus>;
|
||||
export const AlertStatus = z.enum(['open', 'closed', 'acknowledged', 'in-progress']);
|
||||
export type AlertStatusEnum = typeof AlertStatus.enum;
|
||||
|
|
|
|||
|
|
@ -9,19 +9,26 @@ components:
|
|||
AlertIds:
|
||||
type: array
|
||||
items:
|
||||
$ref: './primitives.schema.yaml#/components/schemas/NonEmptyString'
|
||||
type: string
|
||||
minLength: 1
|
||||
format: nonempty
|
||||
minItems: 1
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
|
||||
AlertTag:
|
||||
$ref: './primitives.schema.yaml#/components/schemas/NonEmptyString'
|
||||
type: string
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
description: Use alert tags to organize related alerts into categories that you can filter and group.
|
||||
|
||||
AlertTags:
|
||||
type: array
|
||||
description: List of keywords to organize related alerts into categories that you can filter and group.
|
||||
items:
|
||||
$ref: '#/components/schemas/AlertTag'
|
||||
|
||||
AlertStatus:
|
||||
description: The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.
|
||||
type: string
|
||||
enum:
|
||||
- open
|
||||
|
|
|
|||
|
|
@ -1703,7 +1703,7 @@ finalize it.
|
|||
headers: {
|
||||
[ELASTIC_HTTP_VERSION_HEADER]: '2023-10-31',
|
||||
},
|
||||
method: 'POST',
|
||||
method: 'GET',
|
||||
|
||||
query: props.query,
|
||||
})
|
||||
|
|
|
|||
|
|
@ -65,6 +65,11 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
index_mapping_outdated: false
|
||||
name: .alerts-security.alerts-default
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -163,6 +168,42 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
application: {}
|
||||
cluster:
|
||||
all: true
|
||||
manage: true
|
||||
manage_api_key: true
|
||||
manage_index_templates: true
|
||||
manage_ml: true
|
||||
manage_own_api_key: true
|
||||
manage_pipeline: true
|
||||
manage_security: true
|
||||
manage_transform: true
|
||||
monitor: true
|
||||
monitor_ml: true
|
||||
monitor_transform: true
|
||||
has_all_requested: true
|
||||
has_encryption_key: true
|
||||
index:
|
||||
.alerts-security.alerts-default:
|
||||
all: true
|
||||
create: true
|
||||
create_doc: true
|
||||
create_index: true
|
||||
delete: true
|
||||
delete_index: true
|
||||
index: true
|
||||
maintenance: true
|
||||
manage: true
|
||||
monitor: true
|
||||
read: true
|
||||
view_index_metadata: true
|
||||
write: true
|
||||
is_authenticated: true
|
||||
username: elastic
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -989,6 +1030,25 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
assignees:
|
||||
add:
|
||||
- u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
|
||||
remove: []
|
||||
ids:
|
||||
- >-
|
||||
681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
|
||||
remove:
|
||||
value:
|
||||
assignees:
|
||||
add: []
|
||||
remove:
|
||||
- u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
|
||||
ids:
|
||||
- >-
|
||||
681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -997,13 +1057,32 @@ paths:
|
|||
description: Details about the assignees to assign and unassign.
|
||||
ids:
|
||||
$ref: '#/components/schemas/AlertIds'
|
||||
description: List of alerts ids to assign and unassign passed assignees.
|
||||
required:
|
||||
- assignees
|
||||
- ids
|
||||
required: true
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/ndjson:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
batches: '1,'
|
||||
deleted: '0,'
|
||||
failures: []
|
||||
noops: '0,'
|
||||
requests_per_second: '-1,'
|
||||
retries:
|
||||
- bulk: '0,'
|
||||
- search: 0
|
||||
throttled_millis: '0,'
|
||||
throttled_until_millis: '0,'
|
||||
timed_out: 'false,'
|
||||
took: '76,'
|
||||
total: '1,'
|
||||
updated: '1,'
|
||||
version_conflicts: '0,'
|
||||
description: Indicates a successful call.
|
||||
'400':
|
||||
description: Invalid request.
|
||||
|
|
@ -1025,9 +1104,13 @@ paths:
|
|||
content:
|
||||
application/json:
|
||||
schema:
|
||||
example:
|
||||
migration_ids:
|
||||
- 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
type: object
|
||||
properties:
|
||||
migration_ids:
|
||||
description: Array of `migration_id`s to finalize.
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
|
|
@ -1040,6 +1123,17 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
migrations:
|
||||
- completed: true
|
||||
destinationIndex: .siem-signals-default-000002-r000016
|
||||
id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
sourceIndex: .siem-signals-default-000002
|
||||
status: success
|
||||
updated: '2021-01-06T22:05:56.859Z'
|
||||
version: 16
|
||||
schema:
|
||||
items:
|
||||
$ref: '#/components/schemas/MigrationFinalizationResult'
|
||||
|
|
@ -1093,9 +1187,13 @@ paths:
|
|||
content:
|
||||
application/json:
|
||||
schema:
|
||||
example:
|
||||
migration_ids:
|
||||
- 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
type: object
|
||||
properties:
|
||||
migration_ids:
|
||||
description: Array of `migration_id`s to cleanup.
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
|
|
@ -1108,6 +1206,16 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
migrations:
|
||||
- destinationIndex: .siem-signals-default-000002-r000016
|
||||
id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
sourceIndex: .siem-signals-default-000002
|
||||
status: success
|
||||
updated: 2021-01-06T22:05:56.859Z
|
||||
version: 16
|
||||
schema:
|
||||
items:
|
||||
$ref: '#/components/schemas/MigrationCleanupResult'
|
||||
|
|
@ -1149,13 +1257,21 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
singleIndex:
|
||||
value:
|
||||
index:
|
||||
- .siem-signals-default-000001
|
||||
schema:
|
||||
allOf:
|
||||
- type: object
|
||||
properties:
|
||||
index:
|
||||
description: Array of index names to migrate.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
|
|
@ -1167,6 +1283,13 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
indices:
|
||||
- index: '.siem-signals-default-000001,'
|
||||
migration_id: 923f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
migration_index: .siem-signals-default-000001-r000016
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -1205,7 +1328,7 @@ paths:
|
|||
- Security Detections API
|
||||
- Alerts migration API
|
||||
/api/detection_engine/signals/migration_status:
|
||||
post:
|
||||
get:
|
||||
description: >-
|
||||
Retrieve indices that contain detection alerts of a particular age,
|
||||
along with migration information for each of those indices.
|
||||
|
|
@ -1222,12 +1345,37 @@ paths:
|
|||
|
||||
before its start time. Defaults to now-6m (analyzes data from 6
|
||||
minutes before the start time).
|
||||
example: now-30d
|
||||
format: date-math
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
indices:
|
||||
- index: .siem-signals-default-000002
|
||||
is_outdated: true
|
||||
migrations:
|
||||
- id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
|
||||
status: pending
|
||||
updated: 2021-01-06T20:41:37.173Z
|
||||
version: 16
|
||||
signal_versions:
|
||||
- count: 100
|
||||
version: 15
|
||||
- count: 87
|
||||
version: 16
|
||||
version: 15
|
||||
- index: .siem-signals-default-000003
|
||||
is_outdated: false
|
||||
migrations: []
|
||||
signal_versions:
|
||||
- count: 54
|
||||
version: 16
|
||||
version: 16
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -1269,6 +1417,35 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
query:
|
||||
value:
|
||||
aggs:
|
||||
alertsByGrouping:
|
||||
terms:
|
||||
field: host.name
|
||||
size: 10
|
||||
missingFields:
|
||||
missing:
|
||||
field: host.name
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- bool:
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
must: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
- range:
|
||||
'@timestamp':
|
||||
gte: 2025-01-17T08:00:00.000Z
|
||||
lte: 2025-01-18T07:59:59.999Z
|
||||
runtime_mappings: {}
|
||||
size: 0
|
||||
schema:
|
||||
description: Elasticsearch query and aggregation request
|
||||
type: object
|
||||
|
|
@ -1306,6 +1483,31 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
_shards:
|
||||
failed: 0
|
||||
skipped: 0
|
||||
successful: 1
|
||||
total: 1
|
||||
aggregations:
|
||||
alertsByGrouping:
|
||||
buckets:
|
||||
- doc_count: 5
|
||||
key: Host-f43kkddfyc
|
||||
doc_count_error_upper_bound: 0
|
||||
sum_other_doc_count: 0
|
||||
missingFields:
|
||||
doc_count: 0
|
||||
hits:
|
||||
hits: []
|
||||
max_score: null
|
||||
total:
|
||||
relation: eq
|
||||
value: 5
|
||||
timed_out: false
|
||||
took: 0
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch search response
|
||||
|
|
@ -1342,6 +1544,44 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
signal_ids:
|
||||
- >-
|
||||
80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
|
||||
status: closed
|
||||
byQuery:
|
||||
value:
|
||||
conflicts: proceed
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- '@timestamp':
|
||||
format: strict_date_optional_time
|
||||
gte: 2024-10-23T07:00:00.000Z
|
||||
lte: 2025-01-21T20:12:11.704Z
|
||||
range: null
|
||||
- bool:
|
||||
filter:
|
||||
bool:
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
- '@timestamp':
|
||||
format: strict_date_optional_time
|
||||
gte: 2024-10-23T07:00:00.000Z
|
||||
lte: 2025-01-21T20:12:11.704Z
|
||||
range: null
|
||||
must: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
must: []
|
||||
must_not: []
|
||||
should: []
|
||||
status: closed
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '#/components/schemas/SetAlertsStatusByIds'
|
||||
|
|
@ -1354,6 +1594,41 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
batches: 1
|
||||
deleted: 0
|
||||
failures: []
|
||||
noops: 0
|
||||
requests_per_second: -1
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
throttled_until_millis: 0
|
||||
timed_out: false
|
||||
took: 81
|
||||
total: 1
|
||||
updated: 1
|
||||
version_conflicts: 0
|
||||
byQuery:
|
||||
value:
|
||||
batches: 1
|
||||
deleted: 0
|
||||
failures: []
|
||||
noops: 0
|
||||
requests_per_second: -1
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
throttled_until_millis: 0
|
||||
timed_out: false
|
||||
took: 100
|
||||
total: 17
|
||||
updated: 17
|
||||
version_conflicts: 0
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
|
|
@ -1393,6 +1668,25 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
ids:
|
||||
- >-
|
||||
549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
|
||||
tags:
|
||||
tags_to_add:
|
||||
- Duplicate
|
||||
tags_to_remove: []
|
||||
remove:
|
||||
value:
|
||||
ids:
|
||||
- >-
|
||||
549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
|
||||
tags:
|
||||
tags_to_add: []
|
||||
tags_to_remove:
|
||||
- Duplicate
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -1411,6 +1705,24 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
batches: '1,'
|
||||
deleted: '0,'
|
||||
failures: []
|
||||
noops: '0,'
|
||||
requests_per_second: '-1,'
|
||||
retries:
|
||||
bulk: '0,'
|
||||
search: 0
|
||||
throttled_millis: '0,'
|
||||
throttled_until_millis: '0,'
|
||||
timed_out: 'false,'
|
||||
took: '68,'
|
||||
total: '1,'
|
||||
updated: '1,'
|
||||
version_conflicts: '0,'
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
|
|
@ -1461,22 +1773,28 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
add:
|
||||
description: A list of users ids to assign.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
description: A list of users ids to assign.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
type: array
|
||||
remove:
|
||||
description: A list of users ids to unassign.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
description: A list of users ids to unassign.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- add
|
||||
- remove
|
||||
AlertIds:
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
AlertsIndex:
|
||||
|
|
@ -1521,12 +1839,21 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
requests_per_second:
|
||||
description: >-
|
||||
The throttle for the migration task in sub-requests per second.
|
||||
Corresponds to requests_per_second on the Reindex API.
|
||||
minimum: 1
|
||||
type: integer
|
||||
size:
|
||||
description: >-
|
||||
Number of alerts to migrate per batch. Corresponds to the
|
||||
source.size option on the Reindex API.
|
||||
minimum: 1
|
||||
type: integer
|
||||
slices:
|
||||
description: >-
|
||||
The number of subtasks for the migration task. Corresponds to slices
|
||||
on the Reindex API.
|
||||
minimum: 1
|
||||
type: integer
|
||||
AlertsSort:
|
||||
|
|
@ -1541,6 +1868,9 @@ components:
|
|||
- additionalProperties: true
|
||||
type: object
|
||||
AlertStatus:
|
||||
description: >-
|
||||
The status of an alert, which can be `open`, `acknowledged`,
|
||||
`in-progress`, or `closed`.
|
||||
enum:
|
||||
- open
|
||||
- closed
|
||||
|
|
@ -1592,8 +1922,16 @@ components:
|
|||
- suppress
|
||||
type: string
|
||||
AlertTag:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
description: >-
|
||||
Use alert tags to organize related alerts into categories that you can
|
||||
filter and group.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
AlertTags:
|
||||
description: >-
|
||||
List of keywords to organize related alerts into categories that you can
|
||||
filter and group.
|
||||
items:
|
||||
$ref: '#/components/schemas/AlertTag'
|
||||
type: array
|
||||
|
|
@ -5840,8 +6178,11 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
signal_ids:
|
||||
description: List of alert `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
status:
|
||||
|
|
@ -5867,6 +6208,7 @@ components:
|
|||
- query
|
||||
- status
|
||||
SetAlertTags:
|
||||
description: Object with list of tags to add and remove.
|
||||
type: object
|
||||
properties:
|
||||
tags_to_add:
|
||||
|
|
|
|||
|
|
@ -700,9 +700,11 @@ components:
|
|||
- crowdstrike
|
||||
type: string
|
||||
AlertIds:
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
CaseIds:
|
||||
|
|
@ -919,11 +921,6 @@ components:
|
|||
type: string
|
||||
required:
|
||||
- hostStatuses
|
||||
NonEmptyString:
|
||||
description: A string that does not contain only whitespace characters
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
NoParametersRequestSchema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
|
|||
|
|
@ -32,6 +32,42 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
application: {}
|
||||
cluster:
|
||||
all: true
|
||||
manage: true
|
||||
manage_api_key: true
|
||||
manage_index_templates: true
|
||||
manage_ml: true
|
||||
manage_own_api_key: true
|
||||
manage_pipeline: true
|
||||
manage_security: true
|
||||
manage_transform: true
|
||||
monitor: true
|
||||
monitor_ml: true
|
||||
monitor_transform: true
|
||||
has_all_requested: true
|
||||
has_encryption_key: true
|
||||
index:
|
||||
.alerts-security.alerts-default:
|
||||
all: true
|
||||
create: true
|
||||
create_doc: true
|
||||
create_index: true
|
||||
delete: true
|
||||
delete_index: true
|
||||
index: true
|
||||
maintenance: true
|
||||
manage: true
|
||||
monitor: true
|
||||
read: true
|
||||
view_index_metadata: true
|
||||
write: true
|
||||
is_authenticated: true
|
||||
username: elastic
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -574,6 +610,25 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
assignees:
|
||||
add:
|
||||
- u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
|
||||
remove: []
|
||||
ids:
|
||||
- >-
|
||||
681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
|
||||
remove:
|
||||
value:
|
||||
assignees:
|
||||
add: []
|
||||
remove:
|
||||
- u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
|
||||
ids:
|
||||
- >-
|
||||
681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -582,13 +637,32 @@ paths:
|
|||
description: Details about the assignees to assign and unassign.
|
||||
ids:
|
||||
$ref: '#/components/schemas/AlertIds'
|
||||
description: List of alerts ids to assign and unassign passed assignees.
|
||||
required:
|
||||
- assignees
|
||||
- ids
|
||||
required: true
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/ndjson:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
batches: '1,'
|
||||
deleted: '0,'
|
||||
failures: []
|
||||
noops: '0,'
|
||||
requests_per_second: '-1,'
|
||||
retries:
|
||||
- bulk: '0,'
|
||||
- search: 0
|
||||
throttled_millis: '0,'
|
||||
throttled_until_millis: '0,'
|
||||
timed_out: 'false,'
|
||||
took: '76,'
|
||||
total: '1,'
|
||||
updated: '1,'
|
||||
version_conflicts: '0,'
|
||||
description: Indicates a successful call.
|
||||
'400':
|
||||
description: Invalid request.
|
||||
|
|
@ -602,6 +676,35 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
query:
|
||||
value:
|
||||
aggs:
|
||||
alertsByGrouping:
|
||||
terms:
|
||||
field: host.name
|
||||
size: 10
|
||||
missingFields:
|
||||
missing:
|
||||
field: host.name
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- bool:
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
must: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
- range:
|
||||
'@timestamp':
|
||||
gte: 2025-01-17T08:00:00.000Z
|
||||
lte: 2025-01-18T07:59:59.999Z
|
||||
runtime_mappings: {}
|
||||
size: 0
|
||||
schema:
|
||||
description: Elasticsearch query and aggregation request
|
||||
type: object
|
||||
|
|
@ -639,6 +742,31 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
_shards:
|
||||
failed: 0
|
||||
skipped: 0
|
||||
successful: 1
|
||||
total: 1
|
||||
aggregations:
|
||||
alertsByGrouping:
|
||||
buckets:
|
||||
- doc_count: 5
|
||||
key: Host-f43kkddfyc
|
||||
doc_count_error_upper_bound: 0
|
||||
sum_other_doc_count: 0
|
||||
missingFields:
|
||||
doc_count: 0
|
||||
hits:
|
||||
hits: []
|
||||
max_score: null
|
||||
total:
|
||||
relation: eq
|
||||
value: 5
|
||||
timed_out: false
|
||||
took: 0
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch search response
|
||||
|
|
@ -675,6 +803,44 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
signal_ids:
|
||||
- >-
|
||||
80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
|
||||
status: closed
|
||||
byQuery:
|
||||
value:
|
||||
conflicts: proceed
|
||||
query:
|
||||
bool:
|
||||
filter:
|
||||
- '@timestamp':
|
||||
format: strict_date_optional_time
|
||||
gte: 2024-10-23T07:00:00.000Z
|
||||
lte: 2025-01-21T20:12:11.704Z
|
||||
range: null
|
||||
- bool:
|
||||
filter:
|
||||
bool:
|
||||
filter:
|
||||
- match_phrase:
|
||||
kibana.alert.workflow_status: open
|
||||
- '@timestamp':
|
||||
format: strict_date_optional_time
|
||||
gte: 2024-10-23T07:00:00.000Z
|
||||
lte: 2025-01-21T20:12:11.704Z
|
||||
range: null
|
||||
must: []
|
||||
must_not:
|
||||
- exists:
|
||||
field: kibana.alert.building_block_type
|
||||
should: []
|
||||
must: []
|
||||
must_not: []
|
||||
should: []
|
||||
status: closed
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '#/components/schemas/SetAlertsStatusByIds'
|
||||
|
|
@ -687,6 +853,41 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
byId:
|
||||
value:
|
||||
batches: 1
|
||||
deleted: 0
|
||||
failures: []
|
||||
noops: 0
|
||||
requests_per_second: -1
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
throttled_until_millis: 0
|
||||
timed_out: false
|
||||
took: 81
|
||||
total: 1
|
||||
updated: 1
|
||||
version_conflicts: 0
|
||||
byQuery:
|
||||
value:
|
||||
batches: 1
|
||||
deleted: 0
|
||||
failures: []
|
||||
noops: 0
|
||||
requests_per_second: -1
|
||||
retries:
|
||||
bulk: 0
|
||||
search: 0
|
||||
throttled_millis: 0
|
||||
throttled_until_millis: 0
|
||||
timed_out: false
|
||||
took: 100
|
||||
total: 17
|
||||
updated: 17
|
||||
version_conflicts: 0
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
|
|
@ -726,6 +927,25 @@ paths:
|
|||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
add:
|
||||
value:
|
||||
ids:
|
||||
- >-
|
||||
549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
|
||||
tags:
|
||||
tags_to_add:
|
||||
- Duplicate
|
||||
tags_to_remove: []
|
||||
remove:
|
||||
value:
|
||||
ids:
|
||||
- >-
|
||||
549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
|
||||
tags:
|
||||
tags_to_add: []
|
||||
tags_to_remove:
|
||||
- Duplicate
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
@ -744,6 +964,24 @@ paths:
|
|||
'200':
|
||||
content:
|
||||
application/json:
|
||||
examples:
|
||||
success:
|
||||
value:
|
||||
batches: '1,'
|
||||
deleted: '0,'
|
||||
failures: []
|
||||
noops: '0,'
|
||||
requests_per_second: '-1,'
|
||||
retries:
|
||||
bulk: '0,'
|
||||
search: 0
|
||||
throttled_millis: '0,'
|
||||
throttled_until_millis: '0,'
|
||||
timed_out: 'false,'
|
||||
took: '68,'
|
||||
total: '1,'
|
||||
updated: '1,'
|
||||
version_conflicts: '0,'
|
||||
schema:
|
||||
additionalProperties: true
|
||||
description: Elasticsearch update by query response
|
||||
|
|
@ -794,22 +1032,28 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
add:
|
||||
description: A list of users ids to assign.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
description: A list of users ids to assign.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
type: array
|
||||
remove:
|
||||
description: A list of users ids to unassign.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
description: A list of users ids to unassign.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- add
|
||||
- remove
|
||||
AlertIds:
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
AlertsIndex:
|
||||
|
|
@ -831,6 +1075,9 @@ components:
|
|||
- additionalProperties: true
|
||||
type: object
|
||||
AlertStatus:
|
||||
description: >-
|
||||
The status of an alert, which can be `open`, `acknowledged`,
|
||||
`in-progress`, or `closed`.
|
||||
enum:
|
||||
- open
|
||||
- closed
|
||||
|
|
@ -882,8 +1129,16 @@ components:
|
|||
- suppress
|
||||
type: string
|
||||
AlertTag:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
description: >-
|
||||
Use alert tags to organize related alerts into categories that you can
|
||||
filter and group.
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
AlertTags:
|
||||
description: >-
|
||||
List of keywords to organize related alerts into categories that you can
|
||||
filter and group.
|
||||
items:
|
||||
$ref: '#/components/schemas/AlertTag'
|
||||
type: array
|
||||
|
|
@ -4993,8 +5248,11 @@ components:
|
|||
type: object
|
||||
properties:
|
||||
signal_ids:
|
||||
description: List of alert `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
status:
|
||||
|
|
@ -5020,6 +5278,7 @@ components:
|
|||
- query
|
||||
- status
|
||||
SetAlertTags:
|
||||
description: Object with list of tags to add and remove.
|
||||
type: object
|
||||
properties:
|
||||
tags_to_add:
|
||||
|
|
|
|||
|
|
@ -600,9 +600,11 @@ components:
|
|||
- crowdstrike
|
||||
type: string
|
||||
AlertIds:
|
||||
description: A list of alerts ids.
|
||||
description: A list of alerts `id`s.
|
||||
items:
|
||||
$ref: '#/components/schemas/NonEmptyString'
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
CaseIds:
|
||||
|
|
@ -819,11 +821,6 @@ components:
|
|||
type: string
|
||||
required:
|
||||
- hostStatuses
|
||||
NonEmptyString:
|
||||
description: A string that does not contain only whitespace characters
|
||||
format: nonempty
|
||||
minLength: 1
|
||||
type: string
|
||||
NoParametersRequestSchema:
|
||||
type: object
|
||||
properties:
|
||||
|
|
|
|||
|
|
@ -1131,7 +1131,7 @@ finalize it.
|
|||
kibanaSpace: string = 'default'
|
||||
) {
|
||||
return supertest
|
||||
.post(routeWithNamespace('/api/detection_engine/signals/migration_status', kibanaSpace))
|
||||
.get(routeWithNamespace('/api/detection_engine/signals/migration_status', kibanaSpace))
|
||||
.set('kbn-xsrf', 'true')
|
||||
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
|
||||
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue