Kibana integration

Find alerts

Tool to find and/or aggregate detection alerts in kibana. use this to retrieve a list of alerts, optionally filtering them with a query and performing aggregations.

Get action types

Tool to fetch the list of available action types (e.g., '.slack', '.email', '.webhook') in kibana. use this to discover the 'actiontypeid' needed when creating a new action.

Get alerting rules

Tool to retrieve a list of alerting rules in kibana. use when you need to get a paginated set of rules based on specified conditions.

Get alert types

Tool to retrieve available alert types in kibana. use when you need to get a list of all possible alert types and their metadata.

Get cases

Tool to retrieve a list of cases in kibana. use when you need to find or list existing security or operational cases, potentially filtering by various attributes like status, assignee, or severity.

Get connectors

Tool to retrieve a list of all connectors in kibana. use this tool when you need to get information about available connectors.

Get data views

Tool to retrieve a list of data views available in kibana. use when you need to get a list of available data views, optionally filtering by a name pattern.

Get detection engine rules find

Retrieves a list of detection engine rules based on specified criteria. use this tool to find detection rules.

Get endpoint list items

Tool to retrieve all items from an endpoint exception list. use when you need to get a list of endpoint exceptions, for example, to check existing exceptions before adding a new one.

Get entity store engines

Retrieves the list of engines from the entity store.

Get entity store entities list

Tool to list entity records in the entity store with support for paging, sorting, and filtering. use when you need to retrieve a list of entities such as users, hosts, or services.

Get entity store status

Tool to retrieve the status of the entity store in kibana. use this to check if the entity store is operational.

Delete action

Tool to delete an action in kibana. use when you need to remove a specific action by its id, optionally within a specific space.

Delete alerting rules

Tool to delete an alerting rule in kibana. use when you need to remove a specific alerting rule by its id.

Delete connectors

Tool to delete a connector in kibana. use when you need to remove an existing connector.

Delete fleet output

Tool to delete a specific output configuration in kibana fleet. use when you need to remove an existing output by its id.

Delete fleet proxy

Tool to delete a specific fleet proxy configuration by its id. use when you need to remove an existing proxy setup.

Delete list

Deletes a list. use when you want to delete a list by its id.

Delete osquery saved queries

Tool to delete a saved osquery query by its id. use when you need to remove a specific osquery saved query.

Delete saved objects

Tool to delete a saved object in kibana. use when you need to remove a specific saved object like a visualization or dashboard.

Post alerting rules

Tool to create a new alerting rule in kibana. use when you need to define a new condition that, when met, triggers an alert and potentially executes predefined actions.

Post cases

Tool to create a new case in kibana. use when you need to open and track issues, incidents, or investigations. you can assign users, set severity levels, add tags, and configure external connectors for integration with itsm systems.

Post connectors

Tool to create a new connector in kibana. use when you need to integrate kibana with an external service.

Post dashboards

Tool to create a new dashboard in kibana. use when you need to create a dashboard to visualize data. dashboards can contain visualizations, saved searches, and other embeddable objects.