Finds Knowledge Base Entries that match the given query.
- Base URL
-
https://{kibana_url}
-
GET
/api/security_ai_assistant/knowledge_base/entries/_find
-
GET
/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_find
Auth
Finds Knowledge Base Entries that match the given query.
-
space_id
string
optional
-
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
-
fields
string[]
-
A list of fields to include in the response. If not provided, all fields will be included.
-
Example:
["name","created_at"]
-
filter
string
-
Search query to filter Knowledge Base Entries by specific criteria.
-
Example:
error handling
-
sort_field
enum
-
Field to sort the Knowledge Base Entries by.
-
Values:
created_at
is_default
title
updated_at
-
sort_order
enum
-
Sort order for the results, either asc or desc.
-
Values:
asc
desc
-
page
integer · min: 1 · default: 1
-
Page number for paginated results. Defaults to 1.
-
per_page
integer · min: 0 · default: 20
-
Number of Knowledge Base Entries to return per page. Defaults to 20.
Successful response containing the paginated Knowledge Base Entries.
application/json
-
data
union anyOf[]
required
-
The list of Knowledge Base Entries for the current page.
-
Any of:
-
type
enum
required
-
Entry type.
-
Values:
document
-
global
boolean
required
-
Whether this Knowledge Base Entry is global, defaults to false.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
required
-
Kibana Space, defaults to 'default' space.
-
users
object[]
required
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
createdAt
string
required
-
Time the Knowledge Base Entry was created.
-
createdBy
string
required
-
User who created the Knowledge Base Entry.
-
id
string · format: nonempty · min length: 1
required
-
A string that does not contain only whitespace characters.
-
updatedAt
string
required
-
Time the Knowledge Base Entry was last updated.
-
updatedBy
string
required
-
User who last updated the Knowledge Base Entry.
-
kbResource
enum
required
-
Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
-
Values:
security_labs
defend_insights
user
-
source
string
required
-
Source document name or filepath.
-
text
string
required
-
Knowledge Base Entry content.
-
required
boolean
-
Whether this resource should always be included, defaults to false.
-
vector
object
-
Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
-
-
modelId
string
required
-
ID of the model used to create the embeddings.
-
tokens
map string to number
required
-
Tokens with their corresponding values.
-
type
enum
required
-
Entry type.
-
Values:
index
-
global
boolean
required
-
Whether this Knowledge Base Entry is global, defaults to false.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
required
-
Kibana Space, defaults to 'default' space.
-
users
object[]
required
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
createdAt
string
required
-
Time the Knowledge Base Entry was created.
-
createdBy
string
required
-
User who created the Knowledge Base Entry.
-
id
string · format: nonempty · min length: 1
required
-
A string that does not contain only whitespace characters.
-
updatedAt
string
required
-
Time the Knowledge Base Entry was last updated.
-
updatedBy
string
required
-
User who last updated the Knowledge Base Entry.
-
description
string
required
-
Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string
required
-
Field to query for Knowledge Base content.
-
index
string
required
-
Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string
required
-
Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
inputSchema
object[]
-
Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
-
-
description
string
required
-
Description of the field.
-
fieldName
string
required
-
Name of the field.
-
fieldType
string
required
-
Type of the field.
-
outputFields
string[]
-
Fields to extract from the query result, defaults to all fields if not provided or empty.
-
page
integer
required
-
The current page number.
-
perPage
integer
required
-
The number of Knowledge Base Entries returned per page.
-
total
integer
required
-
The total number of Knowledge Base Entries available.
-
error
string
-
A short description of the error.
-
message
string
-
A detailed message explaining the error.
-
statusCode
number
-
The HTTP status code of the error.