[DOCS] Update CrowdStrike and SentinelOne connectors (#219887)

This commit is contained in:
Lisa Cawley 2025-05-08 11:34:40 -07:00 committed by GitHub
parent 154ed1ef6f
commit f3115c6746
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 133 additions and 11 deletions

View file

@ -11,10 +11,6 @@ applies_to:
# CrowdStrike connector [crowdstrike-action-type] # CrowdStrike connector [crowdstrike-action-type]
::::{warning}
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
::::
The CrowdStrike connector communicates with CrowdStrike Management Console via REST API. The CrowdStrike connector communicates with CrowdStrike Management Console via REST API.
To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md). To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
@ -41,6 +37,17 @@ CrowdStrike client ID
Client secret Client secret
: The CrowdStrike API client secret to authenticate the client ID. : The CrowdStrike API client secret to authenticate the client ID.
## Test connectors [crowdstrike-action-parameters] ## Test connectors [crowdstrike-action-configuration]
You can test connectors as youre creating or editing the connector in {{kib}}. For example:
:::{image} ../images/crowdstrike-connector-test.png
:screenshot:
:alt: CrowdStrike connector test
:::
The CrowdStrike action has the following configuration properties:
Agent IDs
: Get details about one or more CrowdStrike agent IDs.
At this time, you cannot test the CrowdStrike connector.

View file

@ -11,10 +11,6 @@ applies_to:
# SentinelOne connector [sentinelone-action-type] # SentinelOne connector [sentinelone-action-type]
::::{warning}
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
::::
The SentinelOne connector communicates with SentinelOne Management Console via REST API. The SentinelOne connector communicates with SentinelOne Management Console via REST API.
To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md). To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
@ -40,4 +36,11 @@ URL
## Test connectors [sentinelone-action-parameters] ## Test connectors [sentinelone-action-parameters]
At this time, you cannot test the SentinelOne connector. You can test connectors as you're creating or editing the connector in {{kib}}.
For example:
:::{image} ../images/sentinelone-connector-test.png
:alt: SentinelOne connector test
:screenshot:
:::

Binary file not shown.

After

Width:  |  Height:  |  Size: 84 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 174 KiB

After

Width:  |  Height:  |  Size: 130 KiB

Before After
Before After

Binary file not shown.

After

Width:  |  Height:  |  Size: 76 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 142 KiB

After

Width:  |  Height:  |  Size: 115 KiB

Before After
Before After

View file

@ -646,6 +646,8 @@ paths:
- $ref: '#/components/schemas/run_closeincident' - $ref: '#/components/schemas/run_closeincident'
- $ref: '#/components/schemas/run_createalert' - $ref: '#/components/schemas/run_createalert'
- $ref: '#/components/schemas/run_fieldsbyissuetype' - $ref: '#/components/schemas/run_fieldsbyissuetype'
- $ref: '#/components/schemas/run_getagentdetails'
- $ref: '#/components/schemas/run_getagents'
- $ref: '#/components/schemas/run_getchoices' - $ref: '#/components/schemas/run_getchoices'
- $ref: '#/components/schemas/run_getfields' - $ref: '#/components/schemas/run_getfields'
- $ref: '#/components/schemas/run_getincident' - $ref: '#/components/schemas/run_getincident'
@ -71032,6 +71034,42 @@ components:
type: string type: string
description: The Jira issue type identifier. description: The Jira issue type identifier.
example: 10024 example: 10024
run_getagentdetails:
title: The getAgentDetails subaction
type: object
required:
- subAction
- subActionParams
description: The `getAgentDetails` subaction for CrowdStrike connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getAgentDetails
subActionParams:
type: object
description: The set of configuration properties for the action.
required:
- ids
properties:
ids:
type: array
description: An array of CrowdStrike agent identifiers.
items:
type: string
run_getagents:
title: The getAgents subaction
type: object
required:
- subAction
description: The `getAgents` subaction for SentinelOne connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getAgents
run_getchoices: run_getchoices:
title: The getChoices subaction title: The getChoices subaction
type: object type: object

View file

@ -698,6 +698,8 @@ paths:
- $ref: '#/components/schemas/run_closeincident' - $ref: '#/components/schemas/run_closeincident'
- $ref: '#/components/schemas/run_createalert' - $ref: '#/components/schemas/run_createalert'
- $ref: '#/components/schemas/run_fieldsbyissuetype' - $ref: '#/components/schemas/run_fieldsbyissuetype'
- $ref: '#/components/schemas/run_getagentdetails'
- $ref: '#/components/schemas/run_getagents'
- $ref: '#/components/schemas/run_getchoices' - $ref: '#/components/schemas/run_getchoices'
- $ref: '#/components/schemas/run_getfields' - $ref: '#/components/schemas/run_getfields'
- $ref: '#/components/schemas/run_getincident' - $ref: '#/components/schemas/run_getincident'
@ -80939,6 +80941,42 @@ components:
type: string type: string
description: The Jira issue type identifier. description: The Jira issue type identifier.
example: 10024 example: 10024
run_getagentdetails:
title: The getAgentDetails subaction
type: object
required:
- subAction
- subActionParams
description: The `getAgentDetails` subaction for CrowdStrike connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getAgentDetails
subActionParams:
type: object
description: The set of configuration properties for the action.
required:
- ids
properties:
ids:
type: array
description: An array of CrowdStrike agent identifiers.
items:
type: string
run_getagents:
title: The getAgents subaction
type: object
required:
- subAction
description: The `getAgents` subaction for SentinelOne connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getAgents
run_getchoices: run_getchoices:
title: The getChoices subaction title: The getChoices subaction
type: object type: object

View file

@ -392,6 +392,8 @@ actions:
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_closeincident.yaml' - $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_closeincident.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_createalert.yaml' - $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_createalert.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_fieldsbyissuetype.yaml' - $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_fieldsbyissuetype.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getagentdetails.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getagents.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getchoices.yaml' - $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getchoices.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getfields.yaml' - $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getfields.yaml'
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getincident.yaml' - $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getincident.yaml'

View file

@ -0,0 +1,23 @@
title: The getAgentDetails subaction
type: object
required:
- subAction
- subActionParams
description: The `getAgentDetails` subaction for CrowdStrike connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getAgentDetails
subActionParams:
type: object
description: The set of configuration properties for the action.
required:
- ids
properties:
ids:
type: array
description: An array of CrowdStrike agent identifiers.
items:
type: string

View file

@ -0,0 +1,11 @@
title: The getAgents subaction
type: object
required:
- subAction
description: The `getAgents` subaction for SentinelOne connectors.
properties:
subAction:
type: string
description: The action to test.
enum:
- getAgents