Body
-
The display name for the connector.
config
object The connector configuration details.
One of: bedrock_configobject crowdstrike_configobject d3security_configobject email_configobject gemini_configobject resilient_configobject index_configobject jira_configobject defender_configobject genai_azure_configobject genai_openai_configobject opsgenie_configobject pagerduty_configobject sentinelone_configobject servicenow_configobject servicenow_itom_configobject slack_api_configobject swimlane_configobject thehive_configobject tines_configobject torq_configobject webhook_configobject cases_webhook_configobject xmatters_configobject Defines properties for connectors when type is
.bedrock
.Defines config properties for connectors when type is
.crowdstrike
.Defines properties for connectors when type is
.d3security
.Defines properties for connectors when type is
.email
.Hide attributes Show attributes
-
The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If
service
isexchange_server
, this property is required. -
The from address for all emails sent by the connector. It must be specified in
user@host-name
format. -
Specifies whether a user and password are required inside the secrets configuration.
Default value is
true
. -
The host name of the service provider. If the
service
iselastic_cloud
(for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. Ifservice
isother
, this property must be defined. -
The port to connect to on the service provider. If the
service
iselastic_cloud
(for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. Ifservice
isother
, this property must be defined. -
Specifies whether the connection to the service provider will use TLS. If the
service
iselastic_cloud
(for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. -
The name of the email service.
Values are
elastic_cloud
,exchange_server
,gmail
,other
,outlook365
, orses
. -
The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If
service
isexchange_server
, this property is required.
Defines properties for connectors when type is
.gemini
.Hide attributes Show attributes
-
The Google Gemini request URL.
-
The generative artificial intelligence model for Google Gemini to use.
Default value is
gemini-2.5-pro
. -
The GCP region where the Vertex AI endpoint enabled.
-
The Google ProjectID that has Vertex AI endpoint enabled.
Defines properties for connectors when type is
.resilient
.Defines properties for connectors when type is
.index
.Hide attributes Show attributes
-
A field that indicates when the document was indexed.
-
The Elasticsearch index to be written to.
-
The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.
Default value is
false
.
Defines properties for connectors when type is
.jira
.Defines properties for connectors when type is
.microsoft_defender_endpoint
.Hide attributes Show attributes
-
The URL of the Microsoft Defender for Endpoint API. If you are using the
xpack.actions.allowedHosts
setting, make sure the hostname is added to the allowed hosts. -
The application (client) identifier for your app in the Azure portal.
-
The OAuth scopes or permission sets for the Microsoft Defender for Endpoint API.
-
The OAuth server URL where authentication is sent and received for the Microsoft Defender for Endpoint API.
-
The tenant identifier for your app in the Azure portal.
Defines properties for connectors when type is
.gen-ai
and the API provider isAzure OpenAI
.Defines properties for connectors when type is
.gen-ai
and the API provider isOpenAI
.Defines properties for connectors when type is
.opsgenie
.Hide attribute Show attribute
-
The Opsgenie URL. For example,
https://api.opsgenie.com
orhttps://api.eu.opsgenie.com
. If you are using thexpack.actions.allowedHosts
setting, add the hostname to the allowed hosts.
Defines properties for connectors when type is
.pagerduty
.Defines properties for connectors when type is
.sentinelone
.Defines properties for connectors when type is
.servicenow
.Hide attributes Show attributes
-
The ServiceNow instance URL.
-
The client ID assigned to your OAuth application. This property is required when
isOAuth
istrue
. -
The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
Default value is
false
. -
The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when
isOAuth
istrue
. -
The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is
Email
, the user identifier should be the user's email address. This property is required whenisOAuth
istrue
. -
Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to
false
, the Elastic application should be installed in ServiceNow.Default value is
true
.
Defines properties for connectors when type is
.servicenow-itom
.Hide attributes Show attributes
-
The ServiceNow instance URL.
-
The client ID assigned to your OAuth application. This property is required when
isOAuth
istrue
. -
The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
Default value is
false
. -
The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when
isOAuth
istrue
. -
The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is
Email
, the user identifier should be the user's email address. This property is required whenisOAuth
istrue
.
Defines properties for connectors when type is
.slack_api
.Defines properties for connectors when type is
.swimlane
.Hide attributes Show attributes
-
The Swimlane instance URL.
-
The Swimlane application ID.
-
The type of connector. Valid values are
all
,alerts
, andcases
.Values are
all
,alerts
, orcases
. -
The field mapping.
Hide mappings attributes Show mappings attributes object
-
Mapping for the alert ID.
-
Mapping for the case ID.
-
Mapping for the case name.
-
Mapping for the case comments.
-
Mapping for the case description.
Hide descriptionConfig attributes Show descriptionConfig attributes object
-
Mapping for the name of the alert's rule.
-
Mapping for the severity.
-
Defines configuration properties for connectors when type is
.thehive
.Hide attributes Show attributes
-
The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.
-
The instance URL in TheHive. If you are using the
xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts.
Defines properties for connectors when type is
.tines
.Defines properties for connectors when type is
.torq
.Defines properties for connectors when type is
.webhook
.Hide attributes Show attributes
-
The type of authentication to use: basic, SSL, or none.
Values are
webhook-authentication-basic
orwebhook-authentication-ssl
. -
A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.
-
If the
authType
iswebhook-authentication-ssl
, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.Values are
ssl-crt-key
orssl-pfx
. -
If true, a username and password for login type authentication must be provided.
Default value is
true
. -
A set of key-value pairs sent as headers with the request.
-
The HTTP request method, either
post
orput
.Values are
post
orput
. Default value ispost
. -
The request URL. If you are using the
xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. -
Controls the verification of certificates. Use
full
to validate that the certificate has an issue date within thenot_before
andnot_after
dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Usecertificate
to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Usenone
to skip certificate validation.Values are
certificate
,full
, ornone
. Default value isfull
.
Defines properties for connectors when type is
.cases-webhook
.Hide attributes Show attributes
-
The type of authentication to use: basic, SSL, or none.
Values are
webhook-authentication-basic
orwebhook-authentication-ssl
. -
A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.
-
If the
authType
iswebhook-authentication-ssl
, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.Values are
ssl-crt-key
orssl-pfx
. -
A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is
case.comment
. Due to Mustache template variables (the text enclosed in triple braces, for example,{{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. -
The REST API HTTP request method to create a case comment in the third-party system. Valid values are
patch
,post
, andput
.Values are
patch
,post
, orput
. Default value isput
. -
The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the
xpack.actions.allowedHosts setting
, add the hostname to the allowed hosts. -
A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are
case.title
andcase.description
. Due to Mustache template variables (which is the text enclosed in triple braces, for example,{{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. -
The REST API HTTP request method to create a case in the third-party system. Valid values are
patch
,post
, andput
.Values are
patch
,post
, orput
. Default value ispost
. -
The JSON key in the create external case response that contains the case ID.
-
The REST API URL to create a case in the third-party system. If you are using the
xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. -
The JSON key in get external case response that contains the case title.
-
The REST API URL to get the case by ID from the third-party system. If you are using the
xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example,{{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. -
If true, a username and password for login type authentication must be provided.
Default value is
true
. -
A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.
-
The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are
case.title
andcase.description
. Due to Mustache template variables (which is the text enclosed in triple braces, for example,{{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. -
The REST API HTTP request method to update the case in the third-party system. Valid values are
patch
,post
, andput
.Values are
patch
,post
, orput
. Default value isput
. -
The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the
xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. -
Controls the verification of certificates. Use
full
to validate that the certificate has an issue date within thenot_before
andnot_after
dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Usecertificate
to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Usenone
to skip certificate validation.Values are
certificate
,full
, ornone
. Default value isfull
. -
The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.
Defines properties for connectors when type is
.xmatters
.Hide attributes Show attributes
-
secrets
object One of: bedrock_secretsobject crowdstrike_secretsobject d3security_secretsobject email_secretsobject gemini_secretsobject resilient_secretsobject jira_secretsobject teams_secretsobject genai_secretsobject opsgenie_secretsobject pagerduty_secretsobject sentinelone_secretsobject servicenow_secretsobject slack_api_secretsobject swimlane_secretsobject thehive_secretsobject tines_secretsobject torq_secretsobject webhook_secretsobject cases_webhook_secretsobject xmatters_secretsobject Defines secrets for connectors when type is
.bedrock
.Defines secrets for connectors when type is
.crowdstrike
.Defines secrets for connectors when type is
.d3security
.Defines secrets for connectors when type is
.email
.Hide attributes Show attributes
-
The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If
service
isexchange_server
, this property is required. -
The password for HTTP basic authentication. If
hasAuth
is set totrue
, this property is required. -
The username for HTTP basic authentication. If
hasAuth
is set totrue
, this property is required.
Defines secrets for connectors when type is
.gemini
.Defines secrets for connectors when type is
.resilient
.Defines secrets for connectors when type is
.jira
.Defines secrets for connectors when type is
.teams
.Defines secrets for connectors when type is
.gen-ai
. Supports both API key authentication (OpenAI, Azure OpenAI, andOther
) and PKI authentication (Other
provider only). PKI fields must be base64-encoded PEM content.Hide attributes Show attributes
-
The API key for authentication. For OpenAI and Azure OpenAI providers, it is required. For the
Other
provider, it is required if you do not use PKI authentication. With PKI, you can also optionally include an API key if the OpenAI-compatible service supports or requires one. -
Base64-encoded PEM certificate content for PKI authentication (Other provider only). Required for PKI.
Minimum length is
1
. -
Base64-encoded PEM private key content for PKI authentication (Other provider only). Required for PKI.
Minimum length is
1
. -
Base64-encoded PEM CA certificate content for PKI authentication (Other provider only). Optional.
Minimum length is
1
.
Defines secrets for connectors when type is
.opsgenie
.Defines secrets for connectors when type is
.pagerduty
.Defines secrets for connectors when type is
.sentinelone
.Defines secrets for connectors when type is
.servicenow
,.servicenow-sir
, or.servicenow-itom
.Hide attributes Show attributes
-
The client secret assigned to your OAuth application. This property is required when
isOAuth
istrue
. -
The password for HTTP basic authentication. This property is required when
isOAuth
isfalse
. -
The RSA private key that you created for use in ServiceNow. This property is required when
isOAuth
istrue
. -
The password for the RSA private key. This property is required when
isOAuth
istrue
and you set a password on your private key. -
The username for HTTP basic authentication. This property is required when
isOAuth
isfalse
.
Defines secrets for connectors when type is
.slack
.Defines secrets for connectors when type is
.swimlane
.Defines secrets for connectors when type is
.thehive
.Defines secrets for connectors when type is
.tines
.Defines secrets for connectors when type is
.torq
.Defines secrets for connectors when type is
.webhook
.Hide attributes Show attributes
-
If
authType
iswebhook-authentication-ssl
andcertType
isssl-crt-key
, it is a base64 encoded version of the CRT or CERT file. -
If
authType
iswebhook-authentication-ssl
andcertType
isssl-crt-key
, it is a base64 encoded version of the KEY file. -
If
authType
iswebhook-authentication-ssl
andcertType
isssl-pfx
, it is a base64 encoded version of the PFX or P12 file. -
The password for HTTP basic authentication or the passphrase for the SSL certificate files. If
hasAuth
is set totrue
andauthType
iswebhook-authentication-basic
, this property is required. -
The username for HTTP basic authentication. If
hasAuth
is set totrue
andauthType
iswebhook-authentication-basic
, this property is required.
Hide attributes Show attributes
-
If
authType
iswebhook-authentication-ssl
andcertType
isssl-crt-key
, it is a base64 encoded version of the CRT or CERT file. -
If
authType
iswebhook-authentication-ssl
andcertType
isssl-crt-key
, it is a base64 encoded version of the KEY file. -
If
authType
iswebhook-authentication-ssl
andcertType
isssl-pfx
, it is a base64 encoded version of the PFX or P12 file. -
The password for HTTP basic authentication. If
hasAuth
is set totrue
and andauthType
iswebhook-authentication-basic
, this property is required. -
The username for HTTP basic authentication. If
hasAuth
is set totrue
andauthType
iswebhook-authentication-basic
, this property is required.
Defines secrets for connectors when type is
.xmatters
.Hide attributes Show attributes
-
A user name for HTTP basic authentication. It is applicable only when
usesBasic
istrue
. -
The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when
usesBasic
isfalse
. -
A password for HTTP basic authentication. It is applicable only when
usesBasic
istrue
.
-
Responses
-
Indicates a successful call.
Hide response attributes Show response attributes object
-
Additional properties are allowed.
-
The connector type identifier.
-
The identifier for the connector.
-
Indicates whether the connector is deprecated.
-
Indicates whether the connector is missing secrets.
-
Indicates whether the connector is preconfigured. If true, the
config
andis_missing_secrets
properties are omitted from the response. -
Indicates whether the connector is used for system actions.
-
The name of the rule.
-
curl \
--request PUT 'https://<KIBANA_URL>/api/actions/connector/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"updated-connector","config":{"index":"updated-index"}}'
{
"name": "updated-connector",
"config": {
"index": "updated-index"
}
}