mirror of
https://github.com/elastic/kibana.git
synced 2025-06-27 18:51:07 -04:00
[DOCS] Update CrowdStrike and SentinelOne connectors (#219887)
This commit is contained in:
parent
154ed1ef6f
commit
f3115c6746
11 changed files with 133 additions and 11 deletions
|
@ -11,10 +11,6 @@ applies_to:
|
||||||
|
|
||||||
# CrowdStrike connector [crowdstrike-action-type]
|
# CrowdStrike connector [crowdstrike-action-type]
|
||||||
|
|
||||||
::::{warning}
|
|
||||||
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
|
|
||||||
::::
|
|
||||||
|
|
||||||
The CrowdStrike connector communicates with CrowdStrike Management Console via REST API.
|
The CrowdStrike connector communicates with CrowdStrike Management Console via REST API.
|
||||||
|
|
||||||
To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
|
To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
|
||||||
|
@ -41,6 +37,17 @@ CrowdStrike client ID
|
||||||
Client secret
|
Client secret
|
||||||
: The CrowdStrike API client secret to authenticate the client ID.
|
: The CrowdStrike API client secret to authenticate the client ID.
|
||||||
|
|
||||||
## Test connectors [crowdstrike-action-parameters]
|
## Test connectors [crowdstrike-action-configuration]
|
||||||
|
|
||||||
|
You can test connectors as you’re creating or editing the connector in {{kib}}. For example:
|
||||||
|
|
||||||
|
:::{image} ../images/crowdstrike-connector-test.png
|
||||||
|
:screenshot:
|
||||||
|
:alt: CrowdStrike connector test
|
||||||
|
:::
|
||||||
|
|
||||||
|
The CrowdStrike action has the following configuration properties:
|
||||||
|
|
||||||
|
Agent IDs
|
||||||
|
: Get details about one or more CrowdStrike agent IDs.
|
||||||
|
|
||||||
At this time, you cannot test the CrowdStrike connector.
|
|
||||||
|
|
|
@ -11,10 +11,6 @@ applies_to:
|
||||||
|
|
||||||
# SentinelOne connector [sentinelone-action-type]
|
# SentinelOne connector [sentinelone-action-type]
|
||||||
|
|
||||||
::::{warning}
|
|
||||||
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
|
|
||||||
::::
|
|
||||||
|
|
||||||
The SentinelOne connector communicates with SentinelOne Management Console via REST API.
|
The SentinelOne connector communicates with SentinelOne Management Console via REST API.
|
||||||
|
|
||||||
To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
|
To use this connector, you must have authority to run {{endpoint-sec}} connectors, which is an **{{connectors-feature}}** sub-feature privilege. Refer to [{{kib}} privileges](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
|
||||||
|
@ -40,4 +36,11 @@ URL
|
||||||
|
|
||||||
## Test connectors [sentinelone-action-parameters]
|
## Test connectors [sentinelone-action-parameters]
|
||||||
|
|
||||||
At this time, you cannot test the SentinelOne connector.
|
You can test connectors as you're creating or editing the connector in {{kib}}.
|
||||||
|
For example:
|
||||||
|
|
||||||
|
:::{image} ../images/sentinelone-connector-test.png
|
||||||
|
:alt: SentinelOne connector test
|
||||||
|
:screenshot:
|
||||||
|
:::
|
||||||
|
|
||||||
|
|
BIN
docs/reference/images/crowdstrike-connector-test.png
Normal file
BIN
docs/reference/images/crowdstrike-connector-test.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 84 KiB |
Binary file not shown.
Before Width: | Height: | Size: 174 KiB After Width: | Height: | Size: 130 KiB |
BIN
docs/reference/images/sentinelone-connector-test.png
Normal file
BIN
docs/reference/images/sentinelone-connector-test.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 76 KiB |
Binary file not shown.
Before Width: | Height: | Size: 142 KiB After Width: | Height: | Size: 115 KiB |
|
@ -646,6 +646,8 @@ paths:
|
||||||
- $ref: '#/components/schemas/run_closeincident'
|
- $ref: '#/components/schemas/run_closeincident'
|
||||||
- $ref: '#/components/schemas/run_createalert'
|
- $ref: '#/components/schemas/run_createalert'
|
||||||
- $ref: '#/components/schemas/run_fieldsbyissuetype'
|
- $ref: '#/components/schemas/run_fieldsbyissuetype'
|
||||||
|
- $ref: '#/components/schemas/run_getagentdetails'
|
||||||
|
- $ref: '#/components/schemas/run_getagents'
|
||||||
- $ref: '#/components/schemas/run_getchoices'
|
- $ref: '#/components/schemas/run_getchoices'
|
||||||
- $ref: '#/components/schemas/run_getfields'
|
- $ref: '#/components/schemas/run_getfields'
|
||||||
- $ref: '#/components/schemas/run_getincident'
|
- $ref: '#/components/schemas/run_getincident'
|
||||||
|
@ -71032,6 +71034,42 @@ components:
|
||||||
type: string
|
type: string
|
||||||
description: The Jira issue type identifier.
|
description: The Jira issue type identifier.
|
||||||
example: 10024
|
example: 10024
|
||||||
|
run_getagentdetails:
|
||||||
|
title: The getAgentDetails subaction
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- subAction
|
||||||
|
- subActionParams
|
||||||
|
description: The `getAgentDetails` subaction for CrowdStrike connectors.
|
||||||
|
properties:
|
||||||
|
subAction:
|
||||||
|
type: string
|
||||||
|
description: The action to test.
|
||||||
|
enum:
|
||||||
|
- getAgentDetails
|
||||||
|
subActionParams:
|
||||||
|
type: object
|
||||||
|
description: The set of configuration properties for the action.
|
||||||
|
required:
|
||||||
|
- ids
|
||||||
|
properties:
|
||||||
|
ids:
|
||||||
|
type: array
|
||||||
|
description: An array of CrowdStrike agent identifiers.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
run_getagents:
|
||||||
|
title: The getAgents subaction
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- subAction
|
||||||
|
description: The `getAgents` subaction for SentinelOne connectors.
|
||||||
|
properties:
|
||||||
|
subAction:
|
||||||
|
type: string
|
||||||
|
description: The action to test.
|
||||||
|
enum:
|
||||||
|
- getAgents
|
||||||
run_getchoices:
|
run_getchoices:
|
||||||
title: The getChoices subaction
|
title: The getChoices subaction
|
||||||
type: object
|
type: object
|
||||||
|
|
|
@ -698,6 +698,8 @@ paths:
|
||||||
- $ref: '#/components/schemas/run_closeincident'
|
- $ref: '#/components/schemas/run_closeincident'
|
||||||
- $ref: '#/components/schemas/run_createalert'
|
- $ref: '#/components/schemas/run_createalert'
|
||||||
- $ref: '#/components/schemas/run_fieldsbyissuetype'
|
- $ref: '#/components/schemas/run_fieldsbyissuetype'
|
||||||
|
- $ref: '#/components/schemas/run_getagentdetails'
|
||||||
|
- $ref: '#/components/schemas/run_getagents'
|
||||||
- $ref: '#/components/schemas/run_getchoices'
|
- $ref: '#/components/schemas/run_getchoices'
|
||||||
- $ref: '#/components/schemas/run_getfields'
|
- $ref: '#/components/schemas/run_getfields'
|
||||||
- $ref: '#/components/schemas/run_getincident'
|
- $ref: '#/components/schemas/run_getincident'
|
||||||
|
@ -80939,6 +80941,42 @@ components:
|
||||||
type: string
|
type: string
|
||||||
description: The Jira issue type identifier.
|
description: The Jira issue type identifier.
|
||||||
example: 10024
|
example: 10024
|
||||||
|
run_getagentdetails:
|
||||||
|
title: The getAgentDetails subaction
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- subAction
|
||||||
|
- subActionParams
|
||||||
|
description: The `getAgentDetails` subaction for CrowdStrike connectors.
|
||||||
|
properties:
|
||||||
|
subAction:
|
||||||
|
type: string
|
||||||
|
description: The action to test.
|
||||||
|
enum:
|
||||||
|
- getAgentDetails
|
||||||
|
subActionParams:
|
||||||
|
type: object
|
||||||
|
description: The set of configuration properties for the action.
|
||||||
|
required:
|
||||||
|
- ids
|
||||||
|
properties:
|
||||||
|
ids:
|
||||||
|
type: array
|
||||||
|
description: An array of CrowdStrike agent identifiers.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
run_getagents:
|
||||||
|
title: The getAgents subaction
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- subAction
|
||||||
|
description: The `getAgents` subaction for SentinelOne connectors.
|
||||||
|
properties:
|
||||||
|
subAction:
|
||||||
|
type: string
|
||||||
|
description: The action to test.
|
||||||
|
enum:
|
||||||
|
- getAgents
|
||||||
run_getchoices:
|
run_getchoices:
|
||||||
title: The getChoices subaction
|
title: The getChoices subaction
|
||||||
type: object
|
type: object
|
||||||
|
|
|
@ -392,6 +392,8 @@ actions:
|
||||||
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_closeincident.yaml'
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_closeincident.yaml'
|
||||||
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_createalert.yaml'
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_createalert.yaml'
|
||||||
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_fieldsbyissuetype.yaml'
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_fieldsbyissuetype.yaml'
|
||||||
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getagentdetails.yaml'
|
||||||
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getagents.yaml'
|
||||||
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getchoices.yaml'
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getchoices.yaml'
|
||||||
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getfields.yaml'
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getfields.yaml'
|
||||||
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getincident.yaml'
|
- $ref: '../../x-pack/platform/plugins/shared/actions/docs/openapi/components/schemas/run_getincident.yaml'
|
||||||
|
|
|
@ -0,0 +1,23 @@
|
||||||
|
title: The getAgentDetails subaction
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- subAction
|
||||||
|
- subActionParams
|
||||||
|
description: The `getAgentDetails` subaction for CrowdStrike connectors.
|
||||||
|
properties:
|
||||||
|
subAction:
|
||||||
|
type: string
|
||||||
|
description: The action to test.
|
||||||
|
enum:
|
||||||
|
- getAgentDetails
|
||||||
|
subActionParams:
|
||||||
|
type: object
|
||||||
|
description: The set of configuration properties for the action.
|
||||||
|
required:
|
||||||
|
- ids
|
||||||
|
properties:
|
||||||
|
ids:
|
||||||
|
type: array
|
||||||
|
description: An array of CrowdStrike agent identifiers.
|
||||||
|
items:
|
||||||
|
type: string
|
|
@ -0,0 +1,11 @@
|
||||||
|
title: The getAgents subaction
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- subAction
|
||||||
|
description: The `getAgents` subaction for SentinelOne connectors.
|
||||||
|
properties:
|
||||||
|
subAction:
|
||||||
|
type: string
|
||||||
|
description: The action to test.
|
||||||
|
enum:
|
||||||
|
- getAgents
|
Loading…
Add table
Add a link
Reference in a new issue