Test an action that acknowledges or resolves a PagerDuty alert.
dedupKeystring · max length: 255required
The deduplication key for the PagerDuty alert.
eventActionenumrequired
The type of event.
Values:acknowledgeresolve
Test an action that indexes a document into Elasticsearch.
documentsobject[]required
The documents in JSON format for index connectors.
Test an action that sends an email message. There must be at least one recipient in to, cc, or bcc.
bccstring[]
A list of "blind carbon copy" email addresses. Addresses can be specified in user@host-name format or in name <user@host-name> format
ccstring[]
A list of "carbon copy" email addresses. Addresses can be specified in user@host-name format or in name <user@host-name> format
messagestringrequired
The email message text. Markdown format is supported.
subjectstringrequired
The subject line of the email.
tostring[]
A list of email addresses. Addresses can be specified in user@host-name format or in name <user@host-name> format.
Test an action that writes an entry to the Kibana server log.
levelenum · default: info
The log level of the message for server log connectors.
Values:debugerrorfatalinfotracewarn
messagestringrequired
The message for server log connectors.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack.
messagestringrequired
The Slack message text, which cannot contain Markdown, images, or other advanced formatting.
Test an action that triggers a PagerDuty alert.
classstring
The class or type of the event.
componentstring
The component of the source machine that is responsible for the event.
customDetailsobject
Additional details to add to the event.
dedupKeystring · max length: 255
All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.
eventActionenumrequired
The type of event.
Values:trigger
groupstring
The logical grouping of components of a service.
linksobject[]
A list of links to add to the event.
hrefstring
The URL for the link.
textstring
A plain text description of the purpose of the link.
severityenum · default: info
The severity of the event on the affected system.
Values:criticalerrorinfowarning
sourcestring
The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.
summarystring · max length: 1024
A summery of the event.
timestampstring · format: date-time
An ISO-8601 timestamp that indicates when the event was detected or generated.
The addEvent subaction for ServiceNow ITOM connectors.
subActionenumrequired
The action to test.
Values:addEvent
subActionParamsobject
The set of configuration properties for the action.
additional_infostring
Additional information about the event.
descriptionstring
The details about the event.
event_classstring
A specific instance of the source.
message_keystring
All actions sharing this key are associated with the same ServiceNow alert. The default value is <rule ID>:<alert instance ID>.
metric_namestring
The name of the metric.
nodestring
The host that the event was triggered for.
resourcestring
The name of the resource.
severitystring
The severity of the event.
sourcestring
The name of the event source type.
time_of_eventstring
The time of the event.
typestring
The type of event.
The closeAlert subaction for Opsgenie connectors.
subActionenumrequired
The action to test.
Values:closeAlert
subActionParamsobjectrequired
aliasstringrequired
The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
notestring
Additional information for the alert.
sourcestring
The display name for the source of the alert.
userstring
The display name for the owner.
The closeIncident subaction for ServiceNow ITSM connectors.
subActionenumrequired
The action to test.
Values:closeIncident
subActionParamsobjectrequired
incidentobjectrequired
Requires at least one of:correlation_idorexternalId
correlation_idstring · max length: 100 · default: {{rule.id}}:{{alert.id}}nullable
An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
externalIdstringnullable
The unique identifier (incidentId) for the incident in ServiceNow.
The createAlert subaction for Opsgenie and TheHive connectors.
subActionenumrequired
The action to test.
Values:createAlert
subActionParamsobjectrequired
actionsstring[]
The custom actions available to the alert in Opsgenie connectors.
aliasstring
The unique identifier used for alert deduplication in Opsgenie.
descriptionstring
A description that provides detailed information about the alert.
detailsobject
The custom properties of the alert in Opsgenie connectors.
entitystring
The domain of the alert in Opsgenie connectors. For example, the application or server name.
messagestring
The alert message in Opsgenie connectors.
notestring
Additional information for the alert in Opsgenie connectors.
priorityenum
The priority level for the alert in Opsgenie connectors.
Values:P1P2P3P4P5
respondersobject[]
The entities to receive notifications about the alert in Opsgenie connectors. If type is user, either id or username is required. If type is team, either id or name is required.
idstring
The identifier for the entity.
namestring
The name of the entity.
typeenum
The type of responders, in this case escalation.
Values:escalationscheduleteamuser
usernamestring
A valid email address for the user.
severityinteger · min: 1 · max: 4
The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
sourcestring
The display name for the source of the alert in Opsgenie and TheHive connectors.
sourceRefstring
A source reference for the alert in TheHive connectors.
tagsstring[]
The tags for the alert in Opsgenie and TheHive connectors.
titlestring
A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.
tlpinteger · min: 0 · max: 4 · default: 2
The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
typestring
The type of alert in TheHive connectors.
userstring
The display name for the owner.
visibleToobject[]
The teams and users that the alert will be visible to without sending a notification. Only one of id, name, or username is required.
idstring
The identifier for the entity.
namestring
The name of the entity.
typeenumrequired
Valid values are team and user.
Values:teamuser
usernamestring
The user name. This property is required only when the type is user.
The fieldsByIssueType subaction for Jira connectors.
subActionenumrequired
The action to test.
Values:fieldsByIssueType
subActionParamsobjectrequired
idstringrequired
The Jira issue type identifier.
The getAgentDetails subaction for CrowdStrike connectors.
subActionenumrequired
The action to test.
Values:getAgentDetails
subActionParamsobjectrequired
The set of configuration properties for the action.
idsstring[]required
An array of CrowdStrike agent identifiers.
The getAgents subaction for SentinelOne connectors.
subActionenumrequired
The action to test.
Values:getAgents
The getChoices subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
subActionenumrequired
The action to test.
Values:getChoices
subActionParamsobjectrequired
The set of configuration properties for the action.
fieldsstring[]required
An array of fields.
The getFields subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
subActionenumrequired
The action to test.
Values:getFields
The getIncident subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
subActionenumrequired
The action to test.
Values:getIncident
subActionParamsobjectrequired
externalIdstringrequired
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
The issue subaction for Jira connectors.
subActionenumrequired
The action to test.
Values:issue
subActionParamsobject
idstringrequired
The Jira issue identifier.
The issues subaction for Jira connectors.
subActionenumrequired
The action to test.
Values:issues
subActionParamsobjectrequired
titlestringrequired
The title of the Jira issue.
The issueTypes subaction for Jira connectors.
subActionenumrequired
The action to test.
Values:issueTypes
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack_api.
subActionenumrequired
The action to test.
Values:postMessage
subActionParamsobjectrequired
The set of configuration properties for the action.
channelIdsstring[] · max items: 1
The Slack channel identifier, which must be one of the allowedChannels in the connector configuration.
channelsstring[] · max items: 1deprecated
The name of a channel that your Slack app has access to.
textstring · min length: 1
The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.
The pushToService subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
subActionenumrequired
The action to test.
Values:pushToService
subActionParamsobjectrequired
The set of configuration properties for the action.
commentsobject[]
Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.
commentstring
A comment related to the incident. For example, describe how to troubleshoot the issue.
commentIdinteger
A unique identifier for the comment.
incidentobject
Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.
additional_fieldsstring · max length: 20nullable
Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.
alertIdstring
The alert identifier for Swimlane connectors.
caseIdstring
The case identifier for the incident for Swimlane connectors.
caseNamestring
The case name for the incident for Swimlane connectors.
categorystring
The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_displaystring
A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_idstring
The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as {{ruleID}}`:`{{alert ID}} to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of {{ruleID}}`:`{{alert ID}} ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.
descriptionstring
The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
dest_ipunionstring | string[]
A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
externalIdstring
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
idstring
The external case identifier for Webhook - Case Management connectors.
impactstring
The impact of the incident for ServiceNow ITSM connectors.
issueTypeinteger
The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set subAction to issueTypes.
labelsstring[]
The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
malware_hashunionstring | string[]
A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
malware_urlunionstring | string[]
A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
otherFieldsobject · max properties: 20
Custom field identifiers and their values for Jira connectors.
parentstring
The ID or key of the parent issue for Jira connectors. Applies only to Sub-task types of issues.
prioritystring
The priority of the incident in Jira and ServiceNow SecOps connectors.
ruleNamestring
The rule name for Swimlane connectors.
severityinteger
The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
short_descriptionstring
A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
source_ipunionstring | string[]
A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
statusstring
The status of the incident for Webhook - Case Management connectors.
subcategorystring
The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
summarystring
A summary of the incident for Jira connectors.
tagsstring[]
A list of tags for TheHive and Webhook - Case Management connectors.
titlestring
A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.
tlpinteger · min: 0 · max: 4 · default: 2
The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
urgencystring
The urgency of the incident for ServiceNow ITSM connectors.
Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is .slack_api.
Indicates whether the connector type is deprecated.
is_deprecatedbooleanrequired
Indicates whether the connector is deprecated.
is_inbound_events_enabledboolean
Indicates whether this connector can receive inbound events. Always true for inbound-only connectors. For connectors that also send actions, true after inbound events have been turned on.
is_missing_secretsboolean
Indicates whether the connector is missing secrets.
is_preconfiguredbooleanrequired
Indicates whether the connector is preconfigured. If true, the config and is_missing_secrets properties are omitted from the response.
is_system_actionbooleanrequired
Indicates whether the connector is used for system actions.