kibana-alerting - Pinkfish - AI Agents & Workflows for Getting Work Done

Server path: /kibana-alerting | Type: Application | PCID required: Yes

Tools

Tool	Description
`kibana_alerting_delete_actions_connector_id`	Delete a connector
`kibana_alerting_delete_maintenance_window_id`	Delete a maintenance window.
`kibana_alerting_delete_rule_id`	Delete a rule
`kibana_alerting_delete_rule_ruleid_snooze_schedule_scheduleid`	Delete a snooze schedule for a rule
`kibana_alerting_delete_rules_backfill_id`	Delete a backfill by ID
`kibana_alerting_get_actions_connector_id`	Get connector information
`kibana_alerting_get_actions_connector_oauth_callback`	Handle OAuth callback
`kibana_alerting_get_actions_connector_types`	Get connector types
`kibana_alerting_get_actions_connectors`	Get all connectors
`kibana_alerting_get_health`	Get the alerting framework health
`kibana_alerting_get_maintenance_window_find`	Search for a maintenance window.
`kibana_alerting_get_maintenance_window_id`	Get maintenance window details.
`kibana_alerting_get_rule_id`	Get rule details
`kibana_alerting_get_rule_types`	Get the rule types
`kibana_alerting_get_rules_backfill_id`	Get a backfill by ID
`kibana_alerting_get_rules_find`	Get information about rules
`kibana_alerting_patch_maintenance_window_id`	Update a maintenance window.
`kibana_alerting_post_actions_connector_id`	Create a connector
`kibana_alerting_post_actions_connector_id_execute`	Run a connector
`kibana_alerting_post_maintenance_window`	Create a maintenance window.
`kibana_alerting_post_maintenance_window_id_archive`	Archive a maintenance window.
`kibana_alerting_post_maintenance_window_id_unarchive`	Unarchive a maintenance window.
`kibana_alerting_post_rule_id`	Create a rule
`kibana_alerting_post_rule_id_disable`	Disable a rule
`kibana_alerting_post_rule_id_enable`	Enable a rule
`kibana_alerting_post_rule_id_mute_all`	Mute all alerts
`kibana_alerting_post_rule_id_snooze_schedule`	Schedule a snooze for the rule
`kibana_alerting_post_rule_id_unmute_all`	Unmute all alerts
`kibana_alerting_post_rule_id_update_api_key`	Update the API key for a rule
`kibana_alerting_post_rule_rule_id_alert_alert_id_mute`	Mute an alert
`kibana_alerting_post_rule_rule_id_alert_alert_id_unmute`	Unmute an alert
`kibana_alerting_post_rules_backfill_find`	Find backfills for rules
`kibana_alerting_post_rules_backfill_schedule`	Schedule a backfill for rules
`kibana_alerting_put_actions_connector_id`	Update a connector
`kibana_alerting_put_rule_id`	Update a rule

kibana_alerting_delete_actions_connector_id

Delete a connector Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An identifier for the connector.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An identifier for the connector."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_delete_maintenance_window_id

Delete a maintenance window. Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the maintenance window to be deleted.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the maintenance window to be deleted."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_delete_rule_id

Delete a rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_delete_rule_ruleid_snooze_schedule_scheduleid

Delete a snooze schedule for a rule Parameters:

Parameter	Type	Required	Default	Description
`ruleId`	string	Yes	—	The identifier for the rule.
`scheduleId`	string	Yes	—	The identifier for the snooze schedule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "ruleId": {
      "type": "string",
      "description": "The identifier for the rule."
    },
    "scheduleId": {
      "type": "string",
      "description": "The identifier for the snooze schedule."
    }
  },
  "required": [
    "PCID",
    "ruleId",
    "scheduleId"
  ]
}

kibana_alerting_delete_rules_backfill_id

Delete a backfill by ID Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the backfill.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the backfill."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_get_actions_connector_id

Get connector information Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An identifier for the connector.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An identifier for the connector."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_get_actions_connector_oauth_callback

Handle OAuth callback Parameters:

Parameter	Type	Required	Default	Description
`code`	string	No	—	The authorization code returned by the OAuth provider.
`state`	string	No	—	The state parameter for CSRF protection.
`error`	string	No	—	Error code if the authorization failed.
`error_description`	string	No	—	Human-readable error description.
`session_state`	string	No	—	Session state from the OAuth provider (e.g., Microsoft).

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "code": {
      "type": "string",
      "description": "The authorization code returned by the OAuth provider."
    },
    "state": {
      "type": "string",
      "description": "The state parameter for CSRF protection."
    },
    "error": {
      "type": "string",
      "description": "Error code if the authorization failed."
    },
    "error_description": {
      "type": "string",
      "description": "Human-readable error description."
    },
    "session_state": {
      "type": "string",
      "description": "Session state from the OAuth provider (e.g., Microsoft)."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_get_actions_connector_types

Get connector types Parameters:

Parameter	Type	Required	Default	Description
`feature_id`	string	No	—	A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "feature_id": {
      "type": "string",
      "description": "A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases)."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_get_actions_connectors

Get all connectors

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_get_health

Get the alerting framework health

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_get_maintenance_window_find

Search for a maintenance window. Parameters:

Parameter	Type	Required	Default	Description
`title`	string	No	—	The title of the maintenance window.
`created_by`	string	No	—	The user who created the maintenance window.
`status`	string[]	No	—	The status of the maintenance window. It can be “running”, “upcoming”, “finished”, “archived”, or “disabled”.
`page`	number	No	—	The page number to return.
`per_page`	number	No	—	The number of maintenance windows to return per page.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "title": {
      "type": "string",
      "description": "The title of the maintenance window."
    },
    "created_by": {
      "type": "string",
      "description": "The user who created the maintenance window."
    },
    "status": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "running",
          "finished",
          "upcoming",
          "archived",
          "disabled"
        ]
      },
      "description": "The status of the maintenance window. It can be \"running\", \"upcoming\", \"finished\", \"archived\", or \"disabled\"."
    },
    "page": {
      "type": "number",
      "description": "The page number to return."
    },
    "per_page": {
      "type": "number",
      "description": "The number of maintenance windows to return per page."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_get_maintenance_window_id

Get maintenance window details. Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the maintenance window.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the maintenance window."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_get_rule_id

Get rule details Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_get_rule_types

Get the rule types

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_get_rules_backfill_id

Get a backfill by ID Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the backfill.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the backfill."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_get_rules_find

Get information about rules Parameters:

Parameter	Type	Required	Default	Description
`per_page`	number	No	—	The number of rules to return per page.
`page`	number	No	—	The page number to return.
`search`	string	No	—	An Elasticsearch simple_query_string query that filters the objects in the response.
`default_search_operator`	string	No	—	The default operator to use for the simple_query_string.
`search_fields`	string[]	No	—	The fields to perform the simple_query_string parsed query against.
`sort_field`	string	No	—	Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.
`sort_order`	string	No	—	Determines the sort order.
`has_reference`	object	No	—	Filters the rules that have a relation with the reference objects with a specific type and identifier.
`fields`	string[]	No	—	The fields to return in the `attributes` key of the response.
`filter`	string	No	—	A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.
`filter_consumers`	string[]	No	—	Filter Consumers

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "per_page": {
      "type": "number",
      "description": "The number of rules to return per page."
    },
    "page": {
      "type": "number",
      "description": "The page number to return."
    },
    "search": {
      "type": "string",
      "description": "An Elasticsearch simple_query_string query that filters the objects in the response."
    },
    "default_search_operator": {
      "type": "string",
      "description": "The default operator to use for the simple_query_string.",
      "enum": [
        "OR",
        "AND"
      ]
    },
    "search_fields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The fields to perform the simple_query_string parsed query against."
    },
    "sort_field": {
      "type": "string",
      "description": "Determines which field is used to sort the results. The field must exist in the `attributes` key of the response."
    },
    "sort_order": {
      "type": "string",
      "description": "Determines the sort order.",
      "enum": [
        "asc",
        "desc"
      ]
    },
    "has_reference": {
      "type": "object",
      "description": "Filters the rules that have a relation with the reference objects with a specific type and identifier.",
      "properties": {
        "id": {
          "type": "string",
          "description": "The id value"
        },
        "type": {
          "type": "string",
          "description": "The type value"
        }
      },
      "required": [
        "type",
        "id"
      ]
    },
    "fields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The fields to return in the `attributes` key of the response."
    },
    "filter": {
      "type": "string",
      "description": "A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: \"myTitle\"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`."
    },
    "filter_consumers": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter Consumers"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_patch_maintenance_window_id

Update a maintenance window. Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The id value
`enabled`	boolean	No	—	Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
`schedule`	object	No	—	The schedule value
`scope`	object	No	—	The scope value
`title`	string	No	—	The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The id value"
    },
    "enabled": {
      "type": "boolean",
      "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications."
    },
    "schedule": {
      "type": "object",
      "description": "The schedule value",
      "properties": {
        "custom": {
          "type": "object",
          "description": "The custom value"
        }
      },
      "required": [
        "custom"
      ]
    },
    "scope": {
      "type": "object",
      "description": "The scope value",
      "properties": {
        "alerting": {
          "type": "object",
          "description": "The alerting value"
        }
      },
      "required": [
        "alerting"
      ]
    },
    "title": {
      "type": "string",
      "description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_actions_connector_id

Create a connector Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An identifier for the connector.
`config`	object	No	—	The connector configuration details.
`connector_type_id`	string	Yes	—	The type of connector.
`name`	string	Yes	—	The display name for the connector.
`secrets`	object	No	—	The secrets value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An identifier for the connector."
    },
    "config": {
      "description": "The connector configuration details."
    },
    "connector_type_id": {
      "type": "string",
      "description": "The type of connector."
    },
    "name": {
      "type": "string",
      "description": "The display name for the connector."
    },
    "secrets": {
      "description": "The secrets value"
    }
  },
  "required": [
    "PCID",
    "id",
    "connector_type_id",
    "name"
  ]
}

kibana_alerting_post_actions_connector_id_execute

Run a connector Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An identifier for the connector.
`params`	object	Yes	—	The params value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An identifier for the connector."
    },
    "params": {
      "description": "The params value"
    }
  },
  "required": [
    "PCID",
    "id",
    "params"
  ]
}

kibana_alerting_post_maintenance_window

Create a maintenance window. Parameters:

Parameter	Type	Required	Default	Description
`enabled`	boolean	No	—	Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
`schedule`	object	Yes	—	The schedule value
`scope`	object	No	—	The scope value
`title`	string	Yes	—	The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "enabled": {
      "type": "boolean",
      "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications."
    },
    "schedule": {
      "type": "object",
      "description": "The schedule value",
      "properties": {
        "custom": {
          "type": "object",
          "description": "The custom value"
        }
      },
      "required": [
        "custom"
      ]
    },
    "scope": {
      "type": "object",
      "description": "The scope value",
      "properties": {
        "alerting": {
          "type": "object",
          "description": "The alerting value"
        }
      },
      "required": [
        "alerting"
      ]
    },
    "title": {
      "type": "string",
      "description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window."
    }
  },
  "required": [
    "PCID",
    "schedule",
    "title"
  ]
}

kibana_alerting_post_maintenance_window_id_archive

Archive a maintenance window. Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the maintenance window to be archived.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the maintenance window to be archived."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_maintenance_window_id_unarchive

Unarchive a maintenance window. Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the maintenance window to be unarchived.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the maintenance window to be unarchived."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_rule_id

Create a rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule. If it is omitted, an ID is randomly generated.
`actions`	object[]	No	—	The actions value
`alert_delay`	object	No	—	Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
`artifacts`	object	No	—	The artifacts value
`consumer`	string	Yes	—	The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
`enabled`	boolean	No	—	Indicates whether you want to run the rule on an interval basis after it is created.
`flapping`	object	No	—	When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
`name`	string	Yes	—	The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
`notify_when`	string	No	—	Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
`params`	object	No	—	The parameters for the rule.
`rule_type_id`	string	Yes	—	The rule type identifier.
`schedule`	object	Yes	—	The check interval, which specifies how frequently the rule conditions are checked.
`tags`	string[]	No	—	The tags for the rule.
`throttle`	string	No	—	Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule. If it is omitted, an ID is randomly generated."
    },
    "actions": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "The actions value"
    },
    "alert_delay": {
      "type": "object",
      "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.",
      "properties": {
        "active": {
          "type": "number",
          "description": "The number of consecutive runs that must meet the rule conditions."
        }
      },
      "required": [
        "active"
      ]
    },
    "artifacts": {
      "type": "object",
      "description": "The artifacts value",
      "properties": {
        "dashboards": {
          "type": "array",
          "description": "The dashboards value"
        },
        "investigation_guide": {
          "type": "object",
          "description": "Investigation Guide"
        }
      }
    },
    "consumer": {
      "type": "string",
      "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
    },
    "enabled": {
      "type": "boolean",
      "description": "Indicates whether you want to run the rule on an interval basis after it is created."
    },
    "flapping": {
      "type": "object",
      "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state."
        },
        "look_back_window": {
          "type": "number",
          "description": "The minimum number of runs in which the threshold must be met."
        },
        "status_change_threshold": {
          "type": "number",
          "description": "The minimum number of times an alert must switch states in the look back window."
        }
      },
      "required": [
        "look_back_window",
        "status_change_threshold"
      ]
    },
    "name": {
      "type": "string",
      "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
    },
    "notify_when": {
      "type": "string",
      "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.",
      "enum": [
        "onActionGroupChange",
        "onActiveAlert",
        "onThrottleInterval"
      ]
    },
    "params": {
      "description": "The parameters for the rule."
    },
    "rule_type_id": {
      "type": "string",
      "description": "The rule type identifier."
    },
    "schedule": {
      "type": "object",
      "description": "The check interval, which specifies how frequently the rule conditions are checked.",
      "properties": {
        "interval": {
          "type": "string",
          "description": "The interval is specified in seconds, minutes, hours, or days."
        }
      },
      "required": [
        "interval"
      ]
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The tags for the rule."
    },
    "throttle": {
      "type": "string",
      "description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values."
    }
  },
  "required": [
    "PCID",
    "id",
    "consumer",
    "name",
    "rule_type_id",
    "schedule"
  ]
}

kibana_alerting_post_rule_id_disable

Disable a rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.
`untrack`	boolean	No	—	Defines whether this rule’s alerts should be untracked.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    },
    "untrack": {
      "type": "boolean",
      "description": "Defines whether this rule's alerts should be untracked."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_rule_id_enable

Enable a rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_rule_id_mute_all

Mute all alerts Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_rule_id_snooze_schedule

Schedule a snooze for the rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	Identifier of the rule.
`schedule`	object	Yes	—	The schedule value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Identifier of the rule."
    },
    "schedule": {
      "type": "object",
      "description": "The schedule value",
      "properties": {
        "custom": {
          "type": "object",
          "description": "The custom value"
        }
      }
    }
  },
  "required": [
    "PCID",
    "id",
    "schedule"
  ]
}

kibana_alerting_post_rule_id_unmute_all

Unmute all alerts Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_rule_id_update_api_key

Update the API key for a rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_alerting_post_rule_rule_id_alert_alert_id_mute

Mute an alert Parameters:

Parameter	Type	Required	Default	Description
`rule_id`	string	Yes	—	The identifier for the rule.
`alert_id`	string	Yes	—	The identifier for the alert.
`validate_alerts_existence`	boolean	No	—	Whether to validate the existence of the alert.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "rule_id": {
      "type": "string",
      "description": "The identifier for the rule."
    },
    "alert_id": {
      "type": "string",
      "description": "The identifier for the alert."
    },
    "validate_alerts_existence": {
      "type": "boolean",
      "description": "Whether to validate the existence of the alert."
    }
  },
  "required": [
    "PCID",
    "rule_id",
    "alert_id"
  ]
}

kibana_alerting_post_rule_rule_id_alert_alert_id_unmute

Unmute an alert Parameters:

Parameter	Type	Required	Default	Description
`rule_id`	string	Yes	—	The identifier for the rule.
`alert_id`	string	Yes	—	The identifier for the alert.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "rule_id": {
      "type": "string",
      "description": "The identifier for the rule."
    },
    "alert_id": {
      "type": "string",
      "description": "The identifier for the alert."
    }
  },
  "required": [
    "PCID",
    "rule_id",
    "alert_id"
  ]
}

kibana_alerting_post_rules_backfill_find

Find backfills for rules Parameters:

Parameter	Type	Required	Default	Description
`end`	string	No	—	The end date for filtering backfills.
`page`	number	No	—	The page number to return.
`per_page`	number	No	—	The number of backfills to return per page.
`rule_ids`	string	No	—	A comma-separated list of rule identifiers.
`initiator`	string	No	—	The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills.
`start`	string	No	—	The start date for filtering backfills.
`sort_field`	string	No	—	The field to sort backfills by.
`sort_order`	string	No	—	The sort order.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "end": {
      "type": "string",
      "description": "The end date for filtering backfills."
    },
    "page": {
      "type": "number",
      "description": "The page number to return."
    },
    "per_page": {
      "type": "number",
      "description": "The number of backfills to return per page."
    },
    "rule_ids": {
      "type": "string",
      "description": "A comma-separated list of rule identifiers."
    },
    "initiator": {
      "type": "string",
      "description": "The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills.",
      "enum": [
        "user",
        "system"
      ]
    },
    "start": {
      "type": "string",
      "description": "The start date for filtering backfills."
    },
    "sort_field": {
      "type": "string",
      "description": "The field to sort backfills by.",
      "enum": [
        "createdAt",
        "start"
      ]
    },
    "sort_order": {
      "type": "string",
      "description": "The sort order.",
      "enum": [
        "asc",
        "desc"
      ]
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_post_rules_backfill_schedule

Schedule a backfill for rules Parameters:

Parameter	Type	Required	Default	Description
`body`	object[]	No	—	Request body

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "Request body"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_alerting_put_actions_connector_id

Update a connector Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An identifier for the connector.
`config`	object	No	—	The connector configuration details.
`name`	string	Yes	—	The display name for the connector.
`secrets`	object	No	—	The secrets value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An identifier for the connector."
    },
    "config": {
      "description": "The connector configuration details."
    },
    "name": {
      "type": "string",
      "description": "The display name for the connector."
    },
    "secrets": {
      "description": "The secrets value"
    }
  },
  "required": [
    "PCID",
    "id",
    "name"
  ]
}

kibana_alerting_put_rule_id

Update a rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	The identifier for the rule.
`actions`	object[]	No	—	The actions value
`alert_delay`	object	No	—	Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
`artifacts`	object	No	—	The artifacts value
`flapping`	object	No	—	When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
`name`	string	Yes	—	The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
`notify_when`	string	No	—	Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
`params`	object	No	—	The parameters for the rule.
`schedule`	object	Yes	—	The schedule value
`tags`	string[]	No	—	The tags value
`throttle`	string	No	—	Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The identifier for the rule."
    },
    "actions": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "The actions value"
    },
    "alert_delay": {
      "type": "object",
      "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.",
      "properties": {
        "active": {
          "type": "number",
          "description": "The number of consecutive runs that must meet the rule conditions."
        }
      },
      "required": [
        "active"
      ]
    },
    "artifacts": {
      "type": "object",
      "description": "The artifacts value",
      "properties": {
        "dashboards": {
          "type": "array",
          "description": "The dashboards value"
        },
        "investigation_guide": {
          "type": "object",
          "description": "Investigation Guide"
        }
      }
    },
    "flapping": {
      "type": "object",
      "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state."
        },
        "look_back_window": {
          "type": "number",
          "description": "The minimum number of runs in which the threshold must be met."
        },
        "status_change_threshold": {
          "type": "number",
          "description": "The minimum number of times an alert must switch states in the look back window."
        }
      },
      "required": [
        "look_back_window",
        "status_change_threshold"
      ]
    },
    "name": {
      "type": "string",
      "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
    },
    "notify_when": {
      "type": "string",
      "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.",
      "enum": [
        "onActionGroupChange",
        "onActiveAlert",
        "onThrottleInterval"
      ]
    },
    "params": {
      "type": "object",
      "description": "The parameters for the rule."
    },
    "schedule": {
      "type": "object",
      "description": "The schedule value",
      "properties": {
        "interval": {
          "type": "string",
          "description": "The interval is specified in seconds, minutes, hours, or days."
        }
      },
      "required": [
        "interval"
      ]
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The tags value"
    },
    "throttle": {
      "type": "string",
      "description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values."
    }
  },
  "required": [
    "PCID",
    "id",
    "name",
    "schedule"
  ]
}

Triggers API

Platform API

Embedded MCP Servers

Application MCP Servers

Skills Guides

​Tools

​kibana_alerting_delete_actions_connector_id

​kibana_alerting_delete_maintenance_window_id

​kibana_alerting_delete_rule_id

​kibana_alerting_delete_rule_ruleid_snooze_schedule_scheduleid

​kibana_alerting_delete_rules_backfill_id

​kibana_alerting_get_actions_connector_id

​kibana_alerting_get_actions_connector_oauth_callback

​kibana_alerting_get_actions_connector_types

​kibana_alerting_get_actions_connectors

​kibana_alerting_get_health

​kibana_alerting_get_maintenance_window_find

​kibana_alerting_get_maintenance_window_id

​kibana_alerting_get_rule_id

​kibana_alerting_get_rule_types

​kibana_alerting_get_rules_backfill_id

​kibana_alerting_get_rules_find

​kibana_alerting_patch_maintenance_window_id

​kibana_alerting_post_actions_connector_id

​kibana_alerting_post_actions_connector_id_execute

​kibana_alerting_post_maintenance_window

​kibana_alerting_post_maintenance_window_id_archive

​kibana_alerting_post_maintenance_window_id_unarchive

​kibana_alerting_post_rule_id

​kibana_alerting_post_rule_id_disable

​kibana_alerting_post_rule_id_enable

​kibana_alerting_post_rule_id_mute_all

​kibana_alerting_post_rule_id_snooze_schedule

​kibana_alerting_post_rule_id_unmute_all

​kibana_alerting_post_rule_id_update_api_key

​kibana_alerting_post_rule_rule_id_alert_alert_id_mute

​kibana_alerting_post_rule_rule_id_alert_alert_id_unmute

​kibana_alerting_post_rules_backfill_find

​kibana_alerting_post_rules_backfill_schedule

​kibana_alerting_put_actions_connector_id

​kibana_alerting_put_rule_id

Tools

kibana_alerting_delete_actions_connector_id

kibana_alerting_delete_maintenance_window_id

kibana_alerting_delete_rule_id

kibana_alerting_delete_rule_ruleid_snooze_schedule_scheduleid

kibana_alerting_delete_rules_backfill_id

kibana_alerting_get_actions_connector_id

kibana_alerting_get_actions_connector_oauth_callback

kibana_alerting_get_actions_connector_types

kibana_alerting_get_actions_connectors

kibana_alerting_get_health

kibana_alerting_get_maintenance_window_find

kibana_alerting_get_maintenance_window_id

kibana_alerting_get_rule_id

kibana_alerting_get_rule_types

kibana_alerting_get_rules_backfill_id

kibana_alerting_get_rules_find

kibana_alerting_patch_maintenance_window_id

kibana_alerting_post_actions_connector_id

kibana_alerting_post_actions_connector_id_execute

kibana_alerting_post_maintenance_window

kibana_alerting_post_maintenance_window_id_archive

kibana_alerting_post_maintenance_window_id_unarchive

kibana_alerting_post_rule_id

kibana_alerting_post_rule_id_disable

kibana_alerting_post_rule_id_enable

kibana_alerting_post_rule_id_mute_all

kibana_alerting_post_rule_id_snooze_schedule

kibana_alerting_post_rule_id_unmute_all

kibana_alerting_post_rule_id_update_api_key

kibana_alerting_post_rule_rule_id_alert_alert_id_mute

kibana_alerting_post_rule_rule_id_alert_alert_id_unmute

kibana_alerting_post_rules_backfill_find

kibana_alerting_post_rules_backfill_schedule

kibana_alerting_put_actions_connector_id

kibana_alerting_put_rule_id