kibana-security - Pinkfish - AI Agents & Workflows for Getting Work Done

Server path: /kibana-security | Type: Application | PCID required: Yes

Tools

Tool	Description
`kibana_security_create_alerts_index`	Create an alerts index
`kibana_security_create_list`	Create a value list
`kibana_security_create_list_item`	Create a value list item
`kibana_security_create_rule`	Create a detection rule
`kibana_security_delete_alerts_index`	Delete an alerts index
`kibana_security_delete_list`	Delete a value list
`kibana_security_delete_list_index`	Delete value list data streams
`kibana_security_delete_list_item`	Delete a value list item
`kibana_security_delete_rule`	Delete a detection rule
`kibana_security_export_list_items`	Export value list items
`kibana_security_export_rules`	Export detection rules
`kibana_security_find_list_items`	Get value list items
`kibana_security_find_lists`	Get value lists
`kibana_security_find_rules`	List all detection rules
`kibana_security_import_list_items`	Import value list items
`kibana_security_import_rules`	Import detection rules
`kibana_security_install_prebuilt_rules_and_timelines`	Install prebuilt detection rules and Timelines
`kibana_security_patch_list`	Patch a value list
`kibana_security_patch_list_item`	Patch a value list item
`kibana_security_patch_rule`	Patch a detection rule
`kibana_security_perform_rules_bulk_action`	Apply a bulk action to detection rules
`kibana_security_read_alerts_index`	Reads the alert index name if it exists
`kibana_security_read_list`	Get value list details
`kibana_security_read_list_index`	Get status of value list data streams
`kibana_security_read_list_item`	Get a value list item
`kibana_security_read_list_privileges`	Get value list privileges
`kibana_security_read_prebuilt_rules_and_timelines_status`	Retrieve the status of prebuilt detection rules and Timelines
`kibana_security_read_privileges`	Returns user privileges for the Kibana space
`kibana_security_read_rule`	Retrieve a detection rule
`kibana_security_read_tags`	List all detection rule tags
`kibana_security_rule_preview`	Preview rule alerts generated on specified time range
`kibana_security_search_alerts`	Find and/or aggregate detection alerts
`kibana_security_set_alert_assignees`	Assign and unassign users from detection alerts
`kibana_security_set_alert_tags`	Add and remove detection alert tags
`kibana_security_set_alerts_status`	Set a detection alert status
`kibana_security_update_list`	Update a value list
`kibana_security_update_list_item`	Update a value list item
`kibana_security_update_rule`	Update a detection rule

kibana_security_create_alerts_index

Create an alerts index

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_create_list

Create a value list Parameters:

Parameter	Type	Required	Default	Description
`description`	string	Yes	—	Describes the value list.
`id`	string	No	—	Value list’s identifier.
`meta`	object	No	—	Placeholder for metadata about the value list.
`name`	string	Yes	—	Value list’s name.
`type`	string	Yes	—	Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)
`version`	integer	No	—	The version value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "description": {
      "type": "string",
      "description": "Describes the value list."
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list."
    },
    "name": {
      "type": "string",
      "description": "Value list's name."
    },
    "type": {
      "type": "string",
      "description": "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:  - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)",
      "enum": [
        "binary",
        "boolean",
        "byte",
        "date",
        "date_nanos",
        "date_range",
        "double",
        "double_range",
        "float",
        "float_range",
        "geo_point",
        "geo_shape",
        "half_float",
        "integer",
        "integer_range",
        "ip",
        "ip_range",
        "keyword",
        "long",
        "long_range",
        "shape",
        "short",
        "text"
      ]
    },
    "version": {
      "type": "integer",
      "description": "The version value"
    }
  },
  "required": [
    "PCID",
    "description",
    "name",
    "type"
  ]
}

kibana_security_create_list_item

Create a value list item Parameters:

Parameter	Type	Required	Default	Description
`id`	string	No	—	Value list item’s identifier.
`list_id`	string	Yes	—	Value list’s identifier.
`meta`	object	No	—	Placeholder for metadata about the value list item.
`refresh`	string	No	—	Determines when changes made by the request are made visible to search.
`value`	string	Yes	—	The value used to evaluate exceptions.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier."
    },
    "list_id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list item."
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions."
    }
  },
  "required": [
    "PCID",
    "list_id",
    "value"
  ]
}

kibana_security_create_rule

Create a detection rule Parameters:

Parameter	Type	Required	Default	Description
`body`	object	Yes	—	Request body

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "Request body"
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

kibana_security_delete_alerts_index

Delete an alerts index

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_delete_list

Delete a value list Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	Value list’s identifier.
`deleteReferences`	boolean	No	—	Determines whether exception items referencing this value list should be deleted.
`ignoreReferences`	boolean	No	—	Determines whether to delete value list without performing any additional checks of where this list may be utilized.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "deleteReferences": {
      "type": "boolean",
      "description": "Determines whether exception items referencing this value list should be deleted."
    },
    "ignoreReferences": {
      "type": "boolean",
      "description": "Determines whether to delete value list without performing any additional checks of where this list may be utilized."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_security_delete_list_index

Delete value list data streams

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_delete_list_item

Delete a value list item Parameters:

Parameter	Type	Required	Default	Description
`id`	string	No	—	Value list item’s identifier. Required if `list_id` and `value` are not specified.
`list_id`	string	No	—	Value list’s identifier. Required if `id` is not specified.
`value`	string	No	—	The value used to evaluate exceptions. Required if `id` is not specified.
`refresh`	string	No	—	Determines when changes made by the request are made visible to search.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier. Required if `list_id` and `value` are not specified."
    },
    "list_id": {
      "type": "string",
      "description": "Value list's identifier. Required if `id` is not specified."
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions. Required if `id` is not specified."
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_delete_rule

Delete a detection rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	No	—	The rule’s `id` value.
`rule_id`	string	No	—	The rule’s `rule_id` value.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The rule's `id` value."
    },
    "rule_id": {
      "type": "string",
      "description": "The rule's `rule_id` value."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_export_list_items

Export value list items Parameters:

Parameter	Type	Required	Default	Description
`list_id`	string	Yes	—	Value list’s `id` to export.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "list_id": {
      "type": "string",
      "description": "Value list's `id` to export."
    }
  },
  "required": [
    "PCID",
    "list_id"
  ]
}

kibana_security_export_rules

Export detection rules Parameters:

Parameter	Type	Required	Default	Description
`exclude_export_details`	boolean	No	—	Determines whether a summary of the exported rules is returned.
`file_name`	string	No	—	File name for saving the exported rules. > info > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.
`objects`	object[]	No	—	Array of objects with a rule’s `rule_id` field. Do not use rule’s `id` here. Exports all rules when unspecified.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "exclude_export_details": {
      "type": "boolean",
      "description": "Determines whether a summary of the exported rules is returned."
    },
    "file_name": {
      "type": "string",
      "description": "File name for saving the exported rules. > info > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL."
    },
    "objects": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_find_list_items

Get value list items Parameters:

Parameter	Type	Required	Default	Description
`list_id`	string	Yes	—	Value list’s identifier.
`page`	integer	No	—	The page number to return.
`per_page`	integer	No	—	The number of list items to return per page.
`sort_field`	string	No	—	Determines which field is used to sort the results.
`sort_order`	string	No	—	Determines the sort order, which can be `desc` or `asc`
`cursor`	string	No	—	Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly.
`filter`	string	No	—	Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "list_id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "page": {
      "type": "integer",
      "description": "The page number to return."
    },
    "per_page": {
      "type": "integer",
      "description": "The number of list items to return per page."
    },
    "sort_field": {
      "type": "string",
      "description": "Determines which field is used to sort the results."
    },
    "sort_order": {
      "type": "string",
      "description": "Determines the sort order, which can be `desc` or `asc`",
      "enum": [
        "desc",
        "asc"
      ]
    },
    "cursor": {
      "type": "string",
      "description": "Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly."
    },
    "filter": {
      "type": "string",
      "description": "Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax."
    }
  },
  "required": [
    "PCID",
    "list_id"
  ]
}

kibana_security_find_lists

Get value lists Parameters:

Parameter	Type	Required	Default	Description
`page`	integer	No	—	The page number to return.
`per_page`	integer	No	—	The number of value lists to return per page.
`sort_field`	string	No	—	Determines which field is used to sort the results.
`sort_order`	string	No	—	Determines the sort order, which can be `desc` or `asc`
`cursor`	string	No	—	Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly.
`filter`	string	No	—	Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "page": {
      "type": "integer",
      "description": "The page number to return."
    },
    "per_page": {
      "type": "integer",
      "description": "The number of value lists to return per page."
    },
    "sort_field": {
      "type": "string",
      "description": "Determines which field is used to sort the results."
    },
    "sort_order": {
      "type": "string",
      "description": "Determines the sort order, which can be `desc` or `asc`",
      "enum": [
        "desc",
        "asc"
      ]
    },
    "cursor": {
      "type": "string",
      "description": "Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly."
    },
    "filter": {
      "type": "string",
      "description": "Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_find_rules

List all detection rules Parameters:

Parameter	Type	Required	Default	Description
`fields`	string[]	No	—	The fields value
`filter`	string	No	—	Search query Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be: - name - enabled - tags - createdBy - interval - updatedBy > info > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.
`sort_field`	string	No	—	Field to sort by
`sort_order`	string	No	—	Sort order
`page`	integer	No	—	Page number
`per_page`	integer	No	—	Rules per page
`gaps_range_start`	string	No	—	Gaps range start
`gaps_range_end`	string	No	—	Gaps range end
`gap_fill_statuses`	string[]	No	—	Gap fill statuses
`gap_auto_fill_scheduler_id`	string	No	—	Gap auto fill scheduler ID used to determine gap fill status for rules

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "fields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The fields value"
    },
    "filter": {
      "type": "string",
      "description": "Search query  Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be: - name - enabled - tags - createdBy - interval - updatedBy > info > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter."
    },
    "sort_field": {
      "type": "string",
      "description": "Field to sort by",
      "enum": [
        "created_at",
        "createdAt",
        "enabled",
        "execution_summary.last_execution.date",
        "execution_summary.last_execution.metrics.execution_gap_duration_s",
        "execution_summary.last_execution.metrics.total_indexing_duration_ms",
        "execution_summary.last_execution.metrics.total_search_duration_ms",
        "execution_summary.last_execution.status",
        "name",
        "risk_score",
        "riskScore",
        "severity",
        "updated_at",
        "updatedAt"
      ]
    },
    "sort_order": {
      "type": "string",
      "description": "Sort order",
      "enum": [
        "asc",
        "desc"
      ]
    },
    "page": {
      "type": "integer",
      "description": "Page number"
    },
    "per_page": {
      "type": "integer",
      "description": "Rules per page"
    },
    "gaps_range_start": {
      "type": "string",
      "description": "Gaps range start"
    },
    "gaps_range_end": {
      "type": "string",
      "description": "Gaps range end"
    },
    "gap_fill_statuses": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "unfilled",
          "in_progress",
          "filled",
          "error"
        ]
      },
      "description": "Gap fill statuses"
    },
    "gap_auto_fill_scheduler_id": {
      "type": "string",
      "description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_import_list_items

Import value list items Parameters:

Parameter	Type	Required	Default	Description
`list_id`	string	No	—	List’s id. Required when importing to an existing list.
`type`	string	No	—	Type of the importing list. Required when importing a new list whose list `id` is not specified.
`refresh`	string	No	—	Determines when changes made by the request are made visible to search.
`file`	string	No	—	A `.txt` or `.csv` file containing newline separated list items.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "list_id": {
      "type": "string",
      "description": "List's id.  Required when importing to an existing list."
    },
    "type": {
      "type": "string",
      "description": "Type of the importing list.  Required when importing a new list whose list `id` is not specified.",
      "enum": [
        "binary",
        "boolean",
        "byte",
        "date",
        "date_nanos",
        "date_range",
        "double",
        "double_range",
        "float",
        "float_range",
        "geo_point",
        "geo_shape",
        "half_float",
        "integer",
        "integer_range",
        "ip",
        "ip_range",
        "keyword",
        "long",
        "long_range",
        "shape",
        "short",
        "text"
      ]
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    },
    "file": {
      "type": "string",
      "description": "A `.txt` or `.csv` file containing newline separated list items."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_import_rules

Import detection rules Parameters:

Parameter	Type	Required	Default	Description
`overwrite`	boolean	No	—	Determines whether existing rules with the same `rule_id` are overwritten.
`overwrite_exceptions`	boolean	No	—	Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.
`overwrite_action_connectors`	boolean	No	—	Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.
`as_new_list`	boolean	No	—	Generates a new list ID for each imported exception list.
`file`	string	No	—	The `.ndjson` file containing the rules.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "overwrite": {
      "type": "boolean",
      "description": "Determines whether existing rules with the same `rule_id` are overwritten."
    },
    "overwrite_exceptions": {
      "type": "boolean",
      "description": "Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten."
    },
    "overwrite_action_connectors": {
      "type": "boolean",
      "description": "Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten."
    },
    "as_new_list": {
      "type": "boolean",
      "description": "Generates a new list ID for each imported exception list."
    },
    "file": {
      "type": "string",
      "description": "The `.ndjson` file containing the rules."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_install_prebuilt_rules_and_timelines

Install prebuilt detection rules and Timelines

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_patch_list

Patch a value list Parameters:

Parameter	Type	Required	Default	Description
`_version`	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
`description`	string	No	—	Describes the value list.
`id`	string	Yes	—	Value list’s identifier.
`meta`	object	No	—	Placeholder for metadata about the value list.
`name`	string	No	—	Value list’s name.
`version`	integer	No	—	The document version number.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "description": {
      "type": "string",
      "description": "Describes the value list."
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list."
    },
    "name": {
      "type": "string",
      "description": "Value list's name."
    },
    "version": {
      "type": "integer",
      "description": "The document version number."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_security_patch_list_item

Patch a value list item Parameters:

Parameter	Type	Required	Default	Description
`_version`	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
`id`	string	Yes	—	Value list item’s identifier.
`meta`	object	No	—	Placeholder for metadata about the value list item.
`refresh`	string	No	—	Determines when changes made by the request are made visible to search.
`value`	string	No	—	The value used to evaluate exceptions.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list item."
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_security_patch_rule

Patch a detection rule Parameters:

Parameter	Type	Required	Default	Description
`body`	object	Yes	—	> info > You cannot modify the `id` or `rule_id` values.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "> info > You cannot modify the `id` or `rule_id` values."
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

kibana_security_perform_rules_bulk_action

Apply a bulk action to detection rules Parameters:

Parameter	Type	Required	Default	Description
`dry_run`	boolean	No	—	Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. > info > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.
`body`	object	No	—	Request body

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "dry_run": {
      "type": "boolean",
      "description": "Enables dry run mode for the request call.  Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.  To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. > info > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response."
    },
    "body": {
      "description": "Request body"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_alerts_index

Reads the alert index name if it exists

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_list

Get value list details Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	Value list’s identifier.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

kibana_security_read_list_index

Get status of value list data streams

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_list_item

Get a value list item Parameters:

Parameter	Type	Required	Default	Description
`id`	string	No	—	Value list item identifier. Required if `list_id` and `value` are not specified.
`list_id`	string	No	—	Value list item list’s `id` identfier. Required if `id` is not specified.
`value`	string	No	—	The value used to evaluate exceptions. Required if `id` is not specified.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list item identifier. Required if `list_id` and `value` are not specified."
    },
    "list_id": {
      "type": "string",
      "description": "Value list item list's `id` identfier. Required if `id` is not specified."
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions. Required if `id` is not specified."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_list_privileges

Get value list privileges

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_prebuilt_rules_and_timelines_status

Retrieve the status of prebuilt detection rules and Timelines

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_privileges

Returns user privileges for the Kibana space

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_rule

Retrieve a detection rule Parameters:

Parameter	Type	Required	Default	Description
`id`	string	No	—	The rule’s `id` value.
`rule_id`	string	No	—	The rule’s `rule_id` value.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The rule's `id` value."
    },
    "rule_id": {
      "type": "string",
      "description": "The rule's `rule_id` value."
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_read_tags

List all detection rule tags

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_rule_preview

Preview rule alerts generated on specified time range Parameters:

Parameter	Type	Required	Default	Description
`enable_logged_requests`	boolean	No	—	Enables logging and returning in response ES queries, performed during rule execution
`body`	object	Yes	—	An object containing tags to add or remove and alert ids the changes will be applied

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "enable_logged_requests": {
      "type": "boolean",
      "description": "Enables logging and returning in response ES queries, performed during rule execution"
    },
    "body": {
      "description": "An object containing tags to add or remove and alert ids the changes will be applied"
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

kibana_security_search_alerts

Find and/or aggregate detection alerts Parameters:

Parameter	Type	Required	Default	Description
`_source`	object	No	—	The source value
`aggs`	object	No	—	The aggs value
`fields`	string[]	No	—	The fields value
`query`	object	No	—	Search query string
`runtime_mappings`	object	No	—	Runtime Mappings
`size`	integer	No	—	The size value
`sort`	object	No	—	Sort order for results
`track_total_hits`	boolean	No	—	Track Total Hits

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_source": {
      "description": "The source value"
    },
    "aggs": {
      "type": "object",
      "description": "The aggs value"
    },
    "fields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The fields value"
    },
    "query": {
      "type": "object",
      "description": "Search query string"
    },
    "runtime_mappings": {
      "type": "object",
      "description": "Runtime Mappings"
    },
    "size": {
      "type": "integer",
      "description": "The size value"
    },
    "sort": {
      "description": "Sort order for results"
    },
    "track_total_hits": {
      "type": "boolean",
      "description": "Track Total Hits"
    }
  },
  "required": [
    "PCID"
  ]
}

kibana_security_set_alert_assignees

Assign and unassign users from detection alerts Parameters:

Parameter	Type	Required	Default	Description
`assignees`	object	Yes	—	The assignees value
`ids`	string[]	Yes	—	A list of alerts `id`s.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "assignees": {
      "type": "object",
      "description": "The assignees value",
      "properties": {
        "add": {
          "type": "array",
          "description": "The add value"
        },
        "remove": {
          "type": "array",
          "description": "The remove value"
        }
      },
      "required": [
        "add",
        "remove"
      ]
    },
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "nonempty"
      },
      "description": "A list of alerts `id`s."
    }
  },
  "required": [
    "PCID",
    "assignees",
    "ids"
  ]
}

kibana_security_set_alert_tags

Add and remove detection alert tags Parameters:

Parameter	Type	Required	Default	Description
`ids`	string[]	Yes	—	A list of alerts `id`s.
`tags`	object	Yes	—	Object with list of tags to add and remove.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "nonempty"
      },
      "description": "A list of alerts `id`s."
    },
    "tags": {
      "type": "object",
      "description": "Object with list of tags to add and remove.",
      "properties": {
        "tags_to_add": {
          "type": "array",
          "description": "List of keywords to organize related alerts into categories that you can filter and group."
        },
        "tags_to_remove": {
          "type": "array",
          "description": "List of keywords to organize related alerts into categories that you can filter and group."
        }
      },
      "required": [
        "tags_to_add",
        "tags_to_remove"
      ]
    }
  },
  "required": [
    "PCID",
    "ids",
    "tags"
  ]
}

kibana_security_set_alerts_status

Set a detection alert status Parameters:

Parameter	Type	Required	Default	Description
`body`	object	Yes	—	An object containing desired status and explicit alert ids or a query to select alerts

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "An object containing desired status and explicit alert ids or a query to select alerts"
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

kibana_security_update_list

Update a value list Parameters:

Parameter	Type	Required	Default	Description
`_version`	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
`description`	string	Yes	—	Describes the value list.
`id`	string	Yes	—	Value list’s identifier.
`meta`	object	No	—	Placeholder for metadata about the value list.
`name`	string	Yes	—	Value list’s name.
`version`	integer	No	—	The document version number.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "description": {
      "type": "string",
      "description": "Describes the value list."
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list."
    },
    "name": {
      "type": "string",
      "description": "Value list's name."
    },
    "version": {
      "type": "integer",
      "description": "The document version number."
    }
  },
  "required": [
    "PCID",
    "description",
    "id",
    "name"
  ]
}

kibana_security_update_list_item

Update a value list item Parameters:

Parameter	Type	Required	Default	Description
`_version`	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
`id`	string	Yes	—	Value list item’s identifier.
`meta`	object	No	—	Placeholder for metadata about the value list item.
`value`	string	Yes	—	The value used to evaluate exceptions.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list item."
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions."
    }
  },
  "required": [
    "PCID",
    "id",
    "value"
  ]
}

kibana_security_update_rule

Update a detection rule Parameters:

Parameter	Type	Required	Default	Description
`body`	object	Yes	—	> info > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "> info > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values."
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

Triggers API

Platform API

Embedded MCP Servers

Application MCP Servers

Skills Guides

​Tools

​kibana_security_create_alerts_index

​kibana_security_create_list

​kibana_security_create_list_item

​kibana_security_create_rule

​kibana_security_delete_alerts_index

​kibana_security_delete_list

​kibana_security_delete_list_index

​kibana_security_delete_list_item

​kibana_security_delete_rule

​kibana_security_export_list_items

​kibana_security_export_rules

​kibana_security_find_list_items

​kibana_security_find_lists

​kibana_security_find_rules

​kibana_security_import_list_items

​kibana_security_import_rules

​kibana_security_install_prebuilt_rules_and_timelines

​kibana_security_patch_list

​kibana_security_patch_list_item

​kibana_security_patch_rule

​kibana_security_perform_rules_bulk_action

​kibana_security_read_alerts_index

​kibana_security_read_list

​kibana_security_read_list_index

​kibana_security_read_list_item

​kibana_security_read_list_privileges

​kibana_security_read_prebuilt_rules_and_timelines_status

​kibana_security_read_privileges

​kibana_security_read_rule

​kibana_security_read_tags

​kibana_security_rule_preview

​kibana_security_search_alerts

​kibana_security_set_alert_assignees

​kibana_security_set_alert_tags

​kibana_security_set_alerts_status

​kibana_security_update_list

​kibana_security_update_list_item

​kibana_security_update_rule

Tools

kibana_security_create_alerts_index

kibana_security_create_list

kibana_security_create_list_item

kibana_security_create_rule

kibana_security_delete_alerts_index

kibana_security_delete_list

kibana_security_delete_list_index

kibana_security_delete_list_item

kibana_security_delete_rule

kibana_security_export_list_items

kibana_security_export_rules

kibana_security_find_list_items

kibana_security_find_lists

kibana_security_find_rules

kibana_security_import_list_items

kibana_security_import_rules

kibana_security_install_prebuilt_rules_and_timelines

kibana_security_patch_list

kibana_security_patch_list_item

kibana_security_patch_rule

kibana_security_perform_rules_bulk_action

kibana_security_read_alerts_index

kibana_security_read_list

kibana_security_read_list_index

kibana_security_read_list_item

kibana_security_read_list_privileges

kibana_security_read_prebuilt_rules_and_timelines_status

kibana_security_read_privileges

kibana_security_read_rule

kibana_security_read_tags

kibana_security_rule_preview

kibana_security_search_alerts

kibana_security_set_alert_assignees

kibana_security_set_alert_tags

kibana_security_set_alerts_status

kibana_security_update_list

kibana_security_update_list_item

kibana_security_update_rule