> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Elastic Security

> Reference for the Tracecat Elastic Security integration: registered actions, required secrets, expected inputs, and example workflow usage.

## (Deprecated) List detection alerts

Action ID: `tools.elastic_security.list_detection_signals`

Deprecated compatibility action. Use `tools.elastic_security.search_detection_alerts` for API-native alert searches.

Reference: [https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts](https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts)

**Deprecated:** Use `tools.elastic_security.search_detection_alerts` for API-native alert searches.

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time for the query (exclusive).
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time for the query (inclusive).
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana endpoint URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of alerts to return.

  Default: `100`.
</ParamField>

<ParamField path="query" type="string | object | null">
  Elastic JSON query DSL. If specified, overrides `start_time` and `end_time`.

  Default: `null`.
</ParamField>

<ParamField path="source_fields" type="array[string] | object | null">
  Source field filter applied to each alert. Pass a list of dotted field
  names to include only those fields, or a dict of `includes` / `excludes`
  for fine-grained control. Maps directly to the Kibana `_source` request
  body parameter. When `null` (default), every field is returned.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Assign detection alert users

Action ID: `tools.elastic_security.assign_detection_alert_users`

Assign or unassign users on Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertassignees](https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertassignees)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="assignees" type="object" required>
  Details about the assignees to assign and unassign. Requires `add` and `remove`, each a list of user profile `uid`s to assign or unassign. Users need to activate their user profile by logging into Kibana at least once.
</ParamField>

<ParamField path="ids" type="array[string]" required>
  A list of alerts `id`s.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Bulk action detection rules

Action ID: `tools.elastic_security.bulk_action_detection_rules`

Apply a bulk action to Elastic Security detection rules.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-performrulesbulkaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-performrulesbulkaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="dry_run" type="boolean | null">
  Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can't be edited and will return errors in the request response. Rules specified in the request will be temporarily updated. These updates won't be written to Elasticsearch. Dry run mode is not supported for the `export` bulk action.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Cancel response action

Action ID: `tools.elastic_security.cancel_response_action`

Cancel an Elastic Endpoint response action.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-cancelaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-cancelaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), parameters (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create detection rule

Action ID: `tools.elastic_security.create_detection_rule`

Create an Elastic Security detection rule.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-createrule](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createrule)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create endpoint script

Action ID: `tools.elastic_security.create_endpoint_script`

Create a script in the Elastic Endpoint response script library.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarycreatescript](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarycreatescript)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base64_content" type="string" required>
  Base64-encoded script file.
</ParamField>

<ParamField path="filename" type="string" required>
  Script filename sent to Elastic.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native multipart script metadata fields.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="content_type" type="string">
  MIME type of the script file.

  Default: `"application/octet-stream"`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create exception list

Action ID: `tools.elastic_security.create_exception_list`

Create an Elastic Security exception list.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlist](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlist)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create exception list item

Action ID: `tools.elastic_security.create_exception_list_item`

Create an item in an Elastic Security exception list.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlistitem](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlistitem)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Delete exception list item

Action ID: `tools.elastic_security.delete_exception_list_item`

Delete an Elastic Security exception list item.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-deleteexceptionlistitem](https://www.elastic.co/docs/api/doc/kibana/operation/operation-deleteexceptionlistitem)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="id" type="string | null">
  Exception item's identifier. Either `id` or `item_id` must be specified.

  Default: `null`.
</ParamField>

<ParamField path="item_id" type="string | null">
  Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified.

  Default: `null`.
</ParamField>

<ParamField path="namespace_type" type="string | null">
  `single` deletes the item in the current Kibana space; `agnostic` deletes an item in a space-agnostic list. Must match the list that owns the item. Defaults to single.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Download response file

Action ID: `tools.elastic_security.download_response_file`

Download a response-action file as base64.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfiledownload](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfiledownload)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="action_id" type="string" required>
  Response action ID.
</ParamField>

<ParamField path="file_id" type="string" required>
  Response file ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Export detection rules

Action ID: `tools.elastic_security.export_detection_rules`

Export Elastic Security detection rules as NDJSON text.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportrules](https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportrules)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="exclude_export_details" type="boolean | null">
  Determines whether a summary of the exported rules is returned. Defaults to `false`.

  Default: `null`.
</ParamField>

<ParamField path="file_name" type="string | null">
  File name for saving the exported rules. Defaults to `export.ndjson`.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Generate endpoint memory dump

Action ID: `tools.elastic_security.generate_endpoint_memory_dump`

Generate a memory dump on an Elastic Endpoint.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgeneratememorydump](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgeneratememorydump)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), parameters (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get endpoint

Action ID: `tools.elastic_security.get_endpoint`

Get Elastic Endpoint metadata by endpoint ID.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadata](https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadata)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="endpoint_id" type="string" required>
  Endpoint ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get endpoint file

Action ID: `tools.elastic_security.get_endpoint_file`

Request a file from one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetfileaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetfileaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), path (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get endpoint processes

Action ID: `tools.elastic_security.get_endpoint_processes`

Get running processes from one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetprocessesaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetprocessesaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get response action

Action ID: `tools.elastic_security.get_response_action`

Get an Elastic Endpoint response action by ID.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionsdetails](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionsdetails)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="action_id" type="string" required>
  Response action ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get response file info

Action ID: `tools.elastic_security.get_response_file_info`

Get information about a file returned by an Endpoint response action.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfileinfo](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfileinfo)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="action_id" type="string" required>
  Response action ID.
</ParamField>

<ParamField path="file_id" type="string" required>
  Response file ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Import detection rules

Action ID: `tools.elastic_security.import_detection_rules`

Import Elastic Security detection rules from an NDJSON file.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-importrules](https://www.elastic.co/docs/api/doc/kibana/operation/operation-importrules)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base64_content" type="string" required>
  Base64-encoded NDJSON rules file.
</ParamField>

<ParamField path="as_new_list" type="boolean | null">
  Generates a new list ID for each imported exception list. Defaults to `false`.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="filename" type="string">
  Filename sent to Elastic.

  Default: `"rules.ndjson"`.
</ParamField>

<ParamField path="overwrite" type="boolean | null">
  Determines whether existing rules with the same `rule_id` are overwritten. Defaults to `false`.

  Default: `null`.
</ParamField>

<ParamField path="overwrite_action_connectors" type="boolean | null">
  Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten. Defaults to `false`.

  Default: `null`.
</ParamField>

<ParamField path="overwrite_exceptions" type="boolean | null">
  Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten. Defaults to `false`.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Isolate endpoint

Action ID: `tools.elastic_security.isolate_endpoint`

Isolate one or more Elastic Endpoints from the network.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointisolateaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointisolateaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List detection rules

Action ID: `tools.elastic_security.list_detection_rules`

List Elastic Security detection rules.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-findrules](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findrules)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="fields" type="array[string] | null">
  List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`). If omitted, the default field set is returned.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  Search query. Filters the returned results according to the value of the specified field, using the `alert.attributes.&lt;field name>:&lt;field value>` syntax, where `&lt;field name>` can be: name, enabled, tags, createdBy, interval, updatedBy. Even though the JSON rule object uses `created_by` and `updated_by` fields, you must use `createdBy` and `updatedBy` fields in the filter.

  Default: `null`.
</ParamField>

<ParamField path="gap_auto_fill_scheduler_id" type="string | null">
  Gap auto fill scheduler ID used to determine gap fill status for rules.

  Default: `null`.
</ParamField>

<ParamField path="gap_fill_statuses" type="array[string] | null">
  Gap fill statuses. Possible values: unfilled, in\_progress, filled, error.

  Default: `null`.
</ParamField>

<ParamField path="gaps_range_end" type="string | null">
  Gaps range end.

  Default: `null`.
</ParamField>

<ParamField path="gaps_range_start" type="string | null">
  Gaps range start.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page number. Defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Rules per page. Defaults to 20.

  Default: `null`.
</ParamField>

<ParamField path="sort_field" type="string | null">
  Field to sort by. Possible values: created\_at, createdAt, enabled, execution\_summary.last\_execution.date, execution\_summary.last\_execution.metrics.execution\_gap\_duration\_s, execution\_summary.last\_execution.metrics.total\_indexing\_duration\_ms, execution\_summary.last\_execution.metrics.total\_search\_duration\_ms, execution\_summary.last\_execution.status, name, risk\_score, riskScore, severity, updated\_at, updatedAt.

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Sort order. Possible values: asc, desc.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List endpoint scripts

Action ID: `tools.elastic_security.list_endpoint_scripts`

List scripts in the Elastic Endpoint response script library.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarylistscripts](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarylistscripts)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="kuery" type="string | null">
  A KQL query string to filter the list of scripts. Nearly all fields in the script object are searchable.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page number of the results to return. Defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  Number of results to return per page. Defaults to 10. Max value is 1000.

  Default: `null`.
</ParamField>

<ParamField path="sortDirection" type="string | null">
  The direction to sort the results by. Defaults to asc (ascending). Allowed values are `asc`, `desc`.

  Default: `null`.
</ParamField>

<ParamField path="sortField" type="string | null">
  The field to sort the results by. Defaults to name. Allowed values are `name`, `createdAt`, `createdBy`, `updatedAt`, `updatedBy`, `fileSize`.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List endpoints

Action ID: `tools.elastic_security.list_endpoints`

List Elastic Endpoint metadata.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadatalist](https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadatalist)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="hostStatuses" type="array[string]" required>
  A set of host statuses to filter the results by (for example, `healthy`, `updating`). Allowed values are `healthy`, `offline`, `updating`, `inactive`, `unenrolled`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="kuery" type="string | null">
  A KQL string to filter the endpoint metadata results.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The page number to return.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The number of endpoints to return per page.

  Default: `null`.
</ParamField>

<ParamField path="sortDirection" type="string | null">
  The sort order, either `asc` or `desc`.

  Default: `null`.
</ParamField>

<ParamField path="sortField" type="string | null">
  The field used to sort the results. Allowed values are `enrolled_at`, `metadata.host.hostname`, `host_status`, `metadata.Endpoint.policy.applied.name`, `metadata.Endpoint.policy.applied.status`, `metadata.host.os.name`, `metadata.host.ip`, `metadata.agent.version`, `last_checkin`.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List exception list items

Action ID: `tools.elastic_security.list_exception_list_items`

List exception conditions within exception-list containers.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlistitems](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlistitems)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="list_id" type="array[string]" required>
  The `list_id`s of the items to fetch.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="array[string] | null">
  Filters the returned results according to the value of the specified field, using the `&lt;field name>:&lt;field value>` syntax.

  Default: `null`.
</ParamField>

<ParamField path="namespace_type" type="array[string] | null">
  Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Possible values: agnostic, single.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The page number to return.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  The number of exception list items to return per page.

  Default: `null`.
</ParamField>

<ParamField path="search" type="string | null">
  Free-text search term applied to exception list item fields (for example a hostname or file path fragment).

  Default: `null`.
</ParamField>

<ParamField path="sort_field" type="string | null">
  Determines which field is used to sort the results.

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Determines the sort order, which can be `desc` or `asc`.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List exception lists

Action ID: `tools.elastic_security.list_exception_lists`

List exception-list containers and metadata. This does not return their exception items.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlists](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlists)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  Filters the returned results according to the value of the specified field. Uses the `so type.field name:field` value syntax, where `so type` can be: exception-list (specify a space-aware exception list) or exception-list-agnostic (specify an exception list that is shared across spaces).

  Default: `null`.
</ParamField>

<ParamField path="namespace_type" type="array[string] | null">
  Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Possible values: agnostic, single.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The page number to return.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  The number of exception lists to return per page.

  Default: `null`.
</ParamField>

<ParamField path="sort_field" type="string | null">
  Determines which field is used to sort the results.

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Determines the sort order, which can be `desc` or `asc`.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List response actions

Action ID: `tools.elastic_security.list_response_actions`

List Elastic Endpoint response actions.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionslist](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionslist)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="agentIds" type="array[string] | null">
  A list of Elastic Agent IDs to filter the response actions by.

  Default: `null`.
</ParamField>

<ParamField path="agentTypes" type="string | null">
  The agent type to filter response actions by. Defaults to `endpoint`. Allowed values are `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="commands" type="array[string] | null">
  A list of response action command names to filter by. Allowed values are `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`.

  Default: `null`.
</ParamField>

<ParamField path="endDate" type="string | null">
  An end date in ISO 8601 format or Date Math format (for example, `now`).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The page number to return.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  The number of response actions to return per page.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="startDate" type="string | null">
  A start date in ISO 8601 format or Date Math format (for example, `now-24h`).

  Default: `null`.
</ParamField>

<ParamField path="types" type="array[string] | null">
  A list of response action types to filter by (`automated`, `manual`).

  Default: `null`.
</ParamField>

<ParamField path="userIds" type="array[string] | null">
  A list of user IDs that submitted the response actions.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

<ParamField path="withOutputs" type="array[string] | null">
  A list of response action IDs whose outputs should be included in the response.

  Default: `null`.
</ParamField>

## Patch detection rule

Action ID: `tools.elastic_security.patch_detection_rule`

Partially update an Elastic Security detection rule.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-patchrule](https://www.elastic.co/docs/api/doc/kibana/operation/operation-patchrule)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Preview detection rule

Action ID: `tools.elastic_security.preview_detection_rule`

Preview alerts generated by an Elastic Security detection rule.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-rulepreview](https://www.elastic.co/docs/api/doc/kibana/operation/operation-rulepreview)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="enable_logged_requests" type="boolean | null">
  Enables logging and returning in response ES queries, performed during rule execution.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Release endpoint

Action ID: `tools.elastic_security.release_endpoint`

Release one or more isolated Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointunisolateaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointunisolateaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run endpoint command

Action ID: `tools.elastic_security.run_endpoint_command`

Run a command on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointexecuteaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointexecuteaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: command (required), endpoint\_ids (required), agent\_type, alert\_ids, case\_ids, comment, timeout.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run endpoint script

Action ID: `tools.elastic_security.run_endpoint_script`

Run a response script on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-runscriptaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-runscriptaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), parameters (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run Osquery live query

Action ID: `tools.elastic_security.run_osquery_live_query`

Run an API-native Osquery live query against Elastic Agents for host investigation.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-osquerycreatelivequery](https://www.elastic.co/docs/api/doc/kibana/operation/operation-osquerycreatelivequery)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native live query JSON request body, including targets and query or pack details.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Scan endpoint path

Action ID: `tools.elastic_security.scan_endpoint_path`

Scan a file or directory on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscanaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscanaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), path (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search attack discoveries

Action ID: `tools.elastic_security.search_attack_discoveries`

Search existing Elastic Attack Discovery results using native filters and pagination.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-attackdiscoveryfind](https://www.elastic.co/docs/api/doc/kibana/operation/operation-attackdiscoveryfind)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="alert_ids" type="array[string] | null">
  Filter results to Attack discoveries that include any of the provided alert IDs.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="connector_names" type="array[string] | null">
  Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, which are distinct from `connector_id` values used to generate Attack discoveries.

  Default: `null`.
</ParamField>

<ParamField path="enable_field_rendering" type="boolean | null">
  Enables a markdown syntax used to render pivot fields. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.

  Default: `null`.
</ParamField>

<ParamField path="end" type="string | null">
  End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").

  Default: `null`.
</ParamField>

<ParamField path="ids" type="array[string] | null">
  Filter results to the Attack discoveries with the specified IDs.

  Default: `null`.
</ParamField>

<ParamField path="include_all_authors" type="boolean | null">
  If `true`, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with `shared`.

  Default: `null`.
</ParamField>

<ParamField path="include_unique_alert_ids" type="boolean | null">
  If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page number to return (used for pagination). Defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Number of Attack discoveries to return per page (used for pagination). Defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="scheduled" type="boolean | null">
  Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.

  Default: `null`.
</ParamField>

<ParamField path="search" type="string | null">
  Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.).

  Default: `null`.
</ParamField>

<ParamField path="shared" type="boolean | null">
  Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user. Mutually exclusive with `include_all_authors`.

  Default: `null`.
</ParamField>

<ParamField path="sort_field" type="string | null">
  Field used to sort results. Possible values: @timestamp. Defaults to @timestamp.

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Sort order direction, `asc` for ascending or `desc` for descending. Possible values: asc, desc. Defaults to desc.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="start" type="string | null">
  Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

  Default: `null`.
</ParamField>

<ParamField path="status" type="array[string] | null">
  Filter by alert workflow status. Provide one or more of the allowed workflow states. Possible values: acknowledged, closed, open.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

<ParamField path="with_replacements" type="boolean | null">
  When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.

  Default: `null`.
</ParamField>

## Search detection alerts

Action ID: `tools.elastic_security.search_detection_alerts`

Find or aggregate Elastic Security detection alerts using the API-native search body.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-searchalerts](https://www.elastic.co/docs/api/doc/kibana/operation/operation-searchalerts)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search entities

Action ID: `tools.elastic_security.search_entities`

Search Elastic Entity Store records for investigation context, including entity risk and asset data.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-security-entity-store-entities](https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-security-entity-store-entities)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="entity_types" type="array[string] | null">
  Entity types to include in the results. Possible values: user, host, service, generic.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="array[string] | null">
  Fields to include in the response.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A Kibana Query Language (KQL) filter for the search-after mode.

  Default: `null`.
</ParamField>

<ParamField path="filterQuery" type="string | null">
  An Elasticsearch query string to filter entities in page mode.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  Page number to return (1-indexed) in page mode.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Number of entities per page in page mode.

  Default: `null`.
</ParamField>

<ParamField path="searchAfter" type="string | null">
  JSON-encoded search\_after value for cursor-based pagination.

  Default: `null`.
</ParamField>

<ParamField path="size" type="integer | null">
  Number of entities to return in search-after mode.

  Default: `null`.
</ParamField>

<ParamField path="sort_field" type="string | null">
  Field to sort results by in page mode.

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Sort order in page mode. Possible values: asc, desc.

  Default: `null`.
</ParamField>

<ParamField path="source" type="array[string] | null">
  Fields to include in the response source.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Set detection alert status

Action ID: `tools.elastic_security.set_detection_alert_status`

Set the status of Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertsstatus](https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertsstatus)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Suspend endpoint process

Action ID: `tools.elastic_security.suspend_endpoint_process`

Suspend a process on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointsuspendprocessaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointsuspendprocessaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), parameters (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Terminate endpoint process

Action ID: `tools.elastic_security.terminate_endpoint_process`

Terminate a process on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointkillprocessaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointkillprocessaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: endpoint\_ids (required), parameters (required), agent\_type, alert\_ids, case\_ids, comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Update detection alert tags

Action ID: `tools.elastic_security.update_detection_alert_tags`

Add or remove tags on Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalerttags](https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalerttags)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="ids" type="array[string]" required>
  A list of alerts `id`s.
</ParamField>

<ParamField path="tags" type="object" required>
  Object with list of tags to add and remove. Requires `tags_to_add` and `tags_to_remove`, each a list of keywords to organize related alerts into categories that you can filter and group.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Upload endpoint file

Action ID: `tools.elastic_security.upload_endpoint_file`

Upload a file to one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointuploadaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointuploadaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base64_content" type="string" required>
  Base64-encoded file content.
</ParamField>

<ParamField path="filename" type="string" required>
  Filename sent to Elastic.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native multipart fields, such as endpoint\_ids and parameters.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="content_type" type="string">
  MIME type of the uploaded file.

  Default: `"application/octet-stream"`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>