Elastic Security

Reference for the Tracecat Elastic Security integration: registered actions, required secrets, expected inputs, and example workflow usage.

(Deprecated) List detection alerts

Action ID: tools.elastic_security.list_detection_signals

Deprecated compatibility action. Use tools.elastic_security.search_detection_alerts for API-native alert searches.

Reference: https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts

Deprecated: Use tools.elastic_security.search_detection_alerts for API-native alert searches.

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

end_time · string · required

End time for the query (exclusive).

start_time · string · required

Start time for the query (inclusive).

base_url · string | null

Kibana endpoint URL (e.g. https://localhost:5601).

Default: null.

limit · integer

Maximum number of alerts to return.

Default: 100.

query · string | object | null

Elastic JSON query DSL. If specified, overrides start_time and end_time.

Default: null.

source_fields · array[string] | object | null

Source field filter applied to each alert. Pass a list of dotted field names to include only those fields, or a dict of includes / excludes for fine-grained control. Maps directly to the Kibana _source request body parameter. When null (default), every field is returned.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Assign detection alert users

Action ID: tools.elastic_security.assign_detection_alert_users

Assign or unassign users on Elastic Security detection alerts.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertassignees

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

assignees · object · required

Details about the assignees to assign and unassign. Requires add and remove, each a list of user profile uids to assign or unassign. Users need to activate their user profile by logging into Kibana at least once.

ids · array[string] · required

A list of alerts ids.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Bulk action detection rules

Action ID: tools.elastic_security.bulk_action_detection_rules

Apply a bulk action to Elastic Security detection rules.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-performrulesbulkaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

dry_run · boolean | null

Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. Dry run mode is not supported for the export bulk action.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Cancel response action

Action ID: tools.elastic_security.cancel_response_action

Cancel an Elastic Endpoint response action.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-cancelaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), parameters (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Create detection rule

Action ID: tools.elastic_security.create_detection_rule

Create an Elastic Security detection rule.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-createrule

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Create endpoint script

Action ID: tools.elastic_security.create_endpoint_script

Create a script in the Elastic Endpoint response script library.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarycreatescript

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base64_content · string · required

Base64-encoded script file.

filename · string · required

Script filename sent to Elastic.

payload · object · required

API-native multipart script metadata fields.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

content_type · string

MIME type of the script file.

Default: "application/octet-stream".

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Create exception list

Action ID: tools.elastic_security.create_exception_list

Create an Elastic Security exception list.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlist

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Create exception list item

Action ID: tools.elastic_security.create_exception_list_item

Create an item in an Elastic Security exception list.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlistitem

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Delete exception list item

Action ID: tools.elastic_security.delete_exception_list_item

Delete an Elastic Security exception list item.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-deleteexceptionlistitem

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

id · string | null

Exception item’s identifier. Either id or item_id must be specified.

Default: null.

item_id · string | null

Human readable exception item string identifier, e.g. trusted-linux-processes. Either id or item_id must be specified.

Default: null.

namespace_type · string | null

single deletes the item in the current Kibana space; agnostic deletes an item in a space-agnostic list. Must match the list that owns the item. Defaults to single.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Download response file

Action ID: tools.elastic_security.download_response_file

Download a response-action file as base64.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfiledownload

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

action_id · string · required

Response action ID.

file_id · string · required

Response file ID.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Export detection rules

Action ID: tools.elastic_security.export_detection_rules

Export Elastic Security detection rules as NDJSON text.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportrules

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

exclude_export_details · boolean | null

Determines whether a summary of the exported rules is returned. Defaults to false.

Default: null.

file_name · string | null

File name for saving the exported rules. Defaults to export.ndjson.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Generate endpoint memory dump

Action ID: tools.elastic_security.generate_endpoint_memory_dump

Generate a memory dump on an Elastic Endpoint.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgeneratememorydump

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), parameters (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get endpoint

Action ID: tools.elastic_security.get_endpoint

Get Elastic Endpoint metadata by endpoint ID.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadata

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

endpoint_id · string · required

Endpoint ID.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get endpoint file

Action ID: tools.elastic_security.get_endpoint_file

Request a file from one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetfileaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), path (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get endpoint processes

Action ID: tools.elastic_security.get_endpoint_processes

Get running processes from one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetprocessesaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get response action

Action ID: tools.elastic_security.get_response_action

Get an Elastic Endpoint response action by ID.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionsdetails

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

action_id · string · required

Response action ID.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get response file info

Action ID: tools.elastic_security.get_response_file_info

Get information about a file returned by an Endpoint response action.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfileinfo

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

action_id · string · required

Response action ID.

file_id · string · required

Response file ID.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Import detection rules

Action ID: tools.elastic_security.import_detection_rules

Import Elastic Security detection rules from an NDJSON file.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-importrules

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base64_content · string · required

Base64-encoded NDJSON rules file.

as_new_list · boolean | null

Generates a new list ID for each imported exception list. Defaults to false.

Default: null.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

filename · string

Filename sent to Elastic.

Default: "rules.ndjson".

overwrite · boolean | null

Determines whether existing rules with the same rule_id are overwritten. Defaults to false.

Default: null.

overwrite_action_connectors · boolean | null

Determines whether existing actions with the same kibana.alert.rule.actions.id are overwritten. Defaults to false.

Default: null.

overwrite_exceptions · boolean | null

Determines whether existing exception lists with the same list_id are overwritten. Both the exception list container and its items are overwritten. Defaults to false.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Isolate endpoint

Action ID: tools.elastic_security.isolate_endpoint

Isolate one or more Elastic Endpoints from the network.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointisolateaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List detection rules

Action ID: tools.elastic_security.list_detection_rules

List Elastic Security detection rules.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-findrules

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

fields · array[string] | null

List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned.

Default: null.

filter · string | null

Search query. Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be: name, enabled, tags, createdBy, interval, updatedBy. Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

Default: null.

gap_auto_fill_scheduler_id · string | null

Gap auto fill scheduler ID used to determine gap fill status for rules.

Default: null.

gap_fill_statuses · array[string] | null

Gap fill statuses. Possible values: unfilled, in_progress, filled, error.

Default: null.

gaps_range_end · string | null

Gaps range end.

Default: null.

gaps_range_start · string | null

Gaps range start.

Default: null.

page · integer | null

Page number. Defaults to 1.

Default: null.

per_page · integer | null

Rules per page. Defaults to 20.

Default: null.

sort_field · string | null

Field to sort by. Possible values: created_at, createdAt, enabled, execution_summary.last_execution.date, execution_summary.last_execution.metrics.execution_gap_duration_s, execution_summary.last_execution.metrics.total_indexing_duration_ms, execution_summary.last_execution.metrics.total_search_duration_ms, execution_summary.last_execution.status, name, risk_score, riskScore, severity, updated_at, updatedAt.

Default: null.

sort_order · string | null

Sort order. Possible values: asc, desc.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List endpoint scripts

Action ID: tools.elastic_security.list_endpoint_scripts

List scripts in the Elastic Endpoint response script library.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarylistscripts

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

kuery · string | null

A KQL query string to filter the list of scripts. Nearly all fields in the script object are searchable.

Default: null.

page · integer | null

Page number of the results to return. Defaults to 1.

Default: null.

pageSize · integer | null

Number of results to return per page. Defaults to 10. Max value is 1000.

Default: null.

sortDirection · string | null

The direction to sort the results by. Defaults to asc (ascending). Allowed values are asc, desc.

Default: null.

sortField · string | null

The field to sort the results by. Defaults to name. Allowed values are name, createdAt, createdBy, updatedAt, updatedBy, fileSize.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List endpoints

Action ID: tools.elastic_security.list_endpoints

List Elastic Endpoint metadata.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadatalist

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

hostStatuses · array[string] · required

A set of host statuses to filter the results by (for example, healthy, updating). Allowed values are healthy, offline, updating, inactive, unenrolled.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

kuery · string | null

A KQL string to filter the endpoint metadata results.

Default: null.

page · integer | null

The page number to return.

Default: null.

pageSize · integer | null

The number of endpoints to return per page.

Default: null.

sortDirection · string | null

The sort order, either asc or desc.

Default: null.

sortField · string | null

The field used to sort the results. Allowed values are enrolled_at, metadata.host.hostname, host_status, metadata.Endpoint.policy.applied.name, metadata.Endpoint.policy.applied.status, metadata.host.os.name, metadata.host.ip, metadata.agent.version, last_checkin.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List exception list items

Action ID: tools.elastic_security.list_exception_list_items

List exception conditions within exception-list containers.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlistitems

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

list_id · array[string] · required

The list_ids of the items to fetch.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

filter · array[string] | null

Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.

Default: null.

namespace_type · array[string] | null

Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Possible values: agnostic, single.

Default: null.

page · integer | null

The page number to return.

Default: null.

per_page · integer | null

The number of exception list items to return per page.

Default: null.

search · string | null

Free-text search term applied to exception list item fields (for example a hostname or file path fragment).

Default: null.

sort_field · string | null

Determines which field is used to sort the results.

Default: null.

sort_order · string | null

Determines the sort order, which can be desc or asc.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List exception lists

Action ID: tools.elastic_security.list_exception_lists

List exception-list containers and metadata. This does not return their exception items.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlists

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

filter · string | null

Filters the returned results according to the value of the specified field. Uses the so type.field name:field value syntax, where so type can be: exception-list (specify a space-aware exception list) or exception-list-agnostic (specify an exception list that is shared across spaces).

Default: null.

namespace_type · array[string] | null

Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Possible values: agnostic, single.

Default: null.

page · integer | null

The page number to return.

Default: null.

per_page · integer | null

The number of exception lists to return per page.

Default: null.

sort_field · string | null

Determines which field is used to sort the results.

Default: null.

sort_order · string | null

Determines the sort order, which can be desc or asc.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List response actions

Action ID: tools.elastic_security.list_response_actions

List Elastic Endpoint response actions.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionslist

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

agentIds · array[string] | null

A list of Elastic Agent IDs to filter the response actions by.

Default: null.

agentTypes · string | null

The agent type to filter response actions by. Defaults to endpoint. Allowed values are endpoint, sentinel_one, crowdstrike, microsoft_defender_endpoint.

Default: null.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

commands · array[string] | null

A list of response action command names to filter by. Allowed values are isolate, unisolate, kill-process, suspend-process, running-processes, get-file, execute, upload, scan, runscript, cancel, memory-dump.

Default: null.

endDate · string | null

An end date in ISO 8601 format or Date Math format (for example, now).

Default: null.

page · integer | null

The page number to return.

Default: null.

pageSize · integer | null

The number of response actions to return per page.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

startDate · string | null

A start date in ISO 8601 format or Date Math format (for example, now-24h).

Default: null.

types · array[string] | null

A list of response action types to filter by (automated, manual).

Default: null.

userIds · array[string] | null

A list of user IDs that submitted the response actions.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

withOutputs · array[string] | null

A list of response action IDs whose outputs should be included in the response.

Default: null.

Patch detection rule

Action ID: tools.elastic_security.patch_detection_rule

Partially update an Elastic Security detection rule.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-patchrule

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Preview detection rule

Action ID: tools.elastic_security.preview_detection_rule

Preview alerts generated by an Elastic Security detection rule.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-rulepreview

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

enable_logged_requests · boolean | null

Enables logging and returning in response ES queries, performed during rule execution.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Release endpoint

Action ID: tools.elastic_security.release_endpoint

Release one or more isolated Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointunisolateaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Run endpoint command

Action ID: tools.elastic_security.run_endpoint_command

Run a command on one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointexecuteaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: command (required), endpoint_ids (required), agent_type, alert_ids, case_ids, comment, timeout.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Run endpoint script

Action ID: tools.elastic_security.run_endpoint_script

Run a response script on one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-runscriptaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), parameters (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Run Osquery live query

Action ID: tools.elastic_security.run_osquery_live_query

Run an API-native Osquery live query against Elastic Agents for host investigation.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-osquerycreatelivequery

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native live query JSON request body, including targets and query or pack details.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Scan endpoint path

Action ID: tools.elastic_security.scan_endpoint_path

Scan a file or directory on one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscanaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), path (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Search attack discoveries

Action ID: tools.elastic_security.search_attack_discoveries

Search existing Elastic Attack Discovery results using native filters and pagination.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-attackdiscoveryfind

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

alert_ids · array[string] | null

Filter results to Attack discoveries that include any of the provided alert IDs.

Default: null.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

connector_names · array[string] | null

Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable connector_name property of an Attack discovery, which are distinct from connector_id values used to generate Attack discoveries.

Default: null.

enable_field_rendering · boolean | null

Enables a markdown syntax used to render pivot fields. This is primarily used for Attack Discovery views within Kibana. Defaults to false.

Default: null.

end · string | null

End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. “now”, “now-24h”).

Default: null.

ids · array[string] | null

Filter results to the Attack discoveries with the specified IDs.

Default: null.

include_all_authors · boolean | null

If true, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with shared.

Default: null.

include_unique_alert_ids · boolean | null

If true, the response will include unique_alert_ids and unique_alert_ids_count aggregated across the matched Attack discoveries.

Default: null.

page · integer | null

Page number to return (used for pagination). Defaults to 1.

Default: null.

per_page · integer | null

Number of Attack discoveries to return per page (used for pagination). Defaults to 10.

Default: null.

scheduled · boolean | null

Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use true to return only scheduled discoveries or false to return only ad-hoc discoveries.

Default: null.

search · string | null

Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.).

Default: null.

shared · boolean | null

Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use true to return only shared discoveries, false to return only those visible to the current user. Mutually exclusive with include_all_authors.

Default: null.

sort_field · string | null

Field used to sort results. Possible values: @timestamp. Defaults to @timestamp.

Default: null.

sort_order · string | null

Sort order direction, asc for ascending or desc for descending. Possible values: asc, desc. Defaults to desc.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

start · string | null

Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. “now-7d”).

Default: null.

status · array[string] | null

Filter by alert workflow status. Provide one or more of the allowed workflow states. Possible values: acknowledged, closed, open.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

with_replacements · boolean | null

When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.

Default: null.

Search detection alerts

Action ID: tools.elastic_security.search_detection_alerts

Find or aggregate Elastic Security detection alerts using the API-native search body.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-searchalerts

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Search entities

Action ID: tools.elastic_security.search_entities

Search Elastic Entity Store records for investigation context, including entity risk and asset data.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-security-entity-store-entities

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

entity_types · array[string] | null

Entity types to include in the results. Possible values: user, host, service, generic.

Default: null.

fields · array[string] | null

Fields to include in the response.

Default: null.

filter · string | null

A Kibana Query Language (KQL) filter for the search-after mode.

Default: null.

filterQuery · string | null

An Elasticsearch query string to filter entities in page mode.

Default: null.

page · integer | null

Page number to return (1-indexed) in page mode.

Default: null.

per_page · integer | null

Number of entities per page in page mode.

Default: null.

searchAfter · string | null

JSON-encoded search_after value for cursor-based pagination.

Default: null.

size · integer | null

Number of entities to return in search-after mode.

Default: null.

sort_field · string | null

Field to sort results by in page mode.

Default: null.

sort_order · string | null

Sort order in page mode. Possible values: asc, desc.

Default: null.

source · array[string] | null

Fields to include in the response source.

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Set detection alert status

Action ID: tools.elastic_security.set_detection_alert_status

Set the status of Elastic Security detection alerts.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertsstatus

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native JSON request body.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Suspend endpoint process

Action ID: tools.elastic_security.suspend_endpoint_process

Suspend a process on one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointsuspendprocessaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), parameters (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Terminate endpoint process

Action ID: tools.elastic_security.terminate_endpoint_process

Terminate a process on one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointkillprocessaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

payload · object · required

API-native request body. Documented fields: endpoint_ids (required), parameters (required), agent_type, alert_ids, case_ids, comment.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Update detection alert tags

Action ID: tools.elastic_security.update_detection_alert_tags

Add or remove tags on Elastic Security detection alerts.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalerttags

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

ids · array[string] · required

A list of alerts ids.

tags · object · required

Object with list of tags to add and remove. Requires tags_to_add and tags_to_remove, each a list of keywords to organize related alerts into categories that you can filter and group.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Upload endpoint file

Action ID: tools.elastic_security.upload_endpoint_file

Upload a file to one or more Elastic Endpoints.

Reference: https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointuploadaction

Secrets

Required secrets:

• elastic_security: required values ELASTIC_API_KEY.

Input fields

base64_content · string · required

Base64-encoded file content.

filename · string · required

Filename sent to Elastic.

payload · object · required

API-native multipart fields, such as endpoint_ids and parameters.

base_url · string | null

Kibana base URL (e.g. https://localhost:5601).

Default: null.

content_type · string

MIME type of the uploaded file.

Default: "application/octet-stream".

space_id · string | null

Optional Kibana space ID. Omit for the default space.

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.