Applies a bulk action to multiple Knowledge Base Entries
- Base URL
-
https://{kibana_url}
-
POST
/api/security_ai_assistant/knowledge_base/entries/_bulk_action
-
POST
/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_bulk_action
Auth
The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.
-
space_id
string
optional
-
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
-
create
union anyOf[]
-
List of Knowledge Base Entries to create.
-
Any of:
-
type
enum
required
-
Entry type.
-
Values:
document
-
global
boolean
-
Whether this Knowledge Base Entry is global, defaults to false.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
-
Kibana Space, defaults to 'default' space.
-
users
object[]
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
kbResource
enum
required
-
Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
-
Values:
security_labs
defend_insights
user
-
source
string
required
-
Source document name or filepath.
-
text
string
required
-
Knowledge Base Entry content.
-
required
boolean
-
Whether this resource should always be included, defaults to false.
-
vector
object
-
Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
-
-
modelId
string
required
-
ID of the model used to create the embeddings.
-
tokens
map string to number
required
-
Tokens with their corresponding values.
-
type
enum
required
-
Entry type.
-
Values:
index
-
global
boolean
-
Whether this Knowledge Base Entry is global, defaults to false.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
-
Kibana Space, defaults to 'default' space.
-
users
object[]
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
description
string
required
-
Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string
required
-
Field to query for Knowledge Base content.
-
index
string
required
-
Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string
required
-
Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
inputSchema
object[]
-
Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
-
-
description
string
required
-
Description of the field.
-
fieldName
string
required
-
Name of the field.
-
fieldType
string
required
-
Type of the field.
-
outputFields
string[]
-
Fields to extract from the query result, defaults to all fields if not provided or empty.
-
delete
object
-
-
ids
string[] · min items: 1
-
Array of Knowledge Base Entry IDs.
-
query
string
-
Query to filter Knowledge Base Entries.
-
update
union anyOf[]
-
List of Knowledge Base Entries to update.
-
Any of:
-
type
enum
required
-
Entry type.
-
Values:
document
-
global
boolean
-
Whether this Knowledge Base Entry is global, defaults to false.
-
id
string · format: nonempty · min length: 1
required
-
A string that does not contain only whitespace characters.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
-
Kibana Space, defaults to 'default' space.
-
users
object[]
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
kbResource
enum
required
-
Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
-
Values:
security_labs
defend_insights
user
-
source
string
required
-
Source document name or filepath.
-
text
string
required
-
Knowledge Base Entry content.
-
required
boolean
-
Whether this resource should always be included, defaults to false.
-
vector
object
-
Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
-
-
modelId
string
required
-
ID of the model used to create the embeddings.
-
tokens
map string to number
required
-
Tokens with their corresponding values.
-
type
enum
required
-
Entry type.
-
Values:
index
-
global
boolean
-
Whether this Knowledge Base Entry is global, defaults to false.
-
id
string · format: nonempty · min length: 1
required
-
A string that does not contain only whitespace characters.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
-
Kibana Space, defaults to 'default' space.
-
users
object[]
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
description
string
required
-
Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string
required
-
Field to query for Knowledge Base content.
-
index
string
required
-
Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string
required
-
Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
inputSchema
object[]
-
Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
-
-
description
string
required
-
Description of the field.
-
fieldName
string
required
-
Name of the field.
-
fieldType
string
required
-
Type of the field.
-
outputFields
string[]
-
Fields to extract from the query result, defaults to all fields if not provided or empty.
Successful bulk operation request
-
attributes
object
required
-
-
errors
object[]
-
List of errors encountered during the bulk action.
-
-
err_code
string
-
Specific error code for the issue.
-
knowledgeBaseEntries
object[]
required
-
List of Knowledge Base Entries that encountered the error.
-
-
id
string
required
-
ID of the Knowledge Base Entry that encountered an error.
-
name
string
-
Name of the Knowledge Base Entry that encountered an error.
-
message
string
required
-
Error message describing the issue.
-
statusCode
integer
required
-
HTTP status code associated with the error.
-
results
object
required
-
-
created
union anyOf[]
required
-
List of Knowledge Base Entries that were successfully created.
-
Any of:
-
type
enum
required
-
Entry type.
-
Values:
document
-
global
boolean
required
-
Whether this Knowledge Base Entry is global, defaults to false.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
required
-
Kibana Space, defaults to 'default' space.
-
users
object[]
required
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
createdAt
string
required
-
Time the Knowledge Base Entry was created.
-
createdBy
string
required
-
User who created the Knowledge Base Entry.
-
id
string · format: nonempty · min length: 1
required
-
A string that does not contain only whitespace characters.
-
updatedAt
string
required
-
Time the Knowledge Base Entry was last updated.
-
updatedBy
string
required
-
User who last updated the Knowledge Base Entry.
-
kbResource
enum
required
-
Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
-
Values:
security_labs
defend_insights
user
-
source
string
required
-
Source document name or filepath.
-
text
string
required
-
Knowledge Base Entry content.
-
required
boolean
-
Whether this resource should always be included, defaults to false.
-
vector
object
-
Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
-
-
modelId
string
required
-
ID of the model used to create the embeddings.
-
tokens
map string to number
required
-
Tokens with their corresponding values.
-
type
enum
required
-
Entry type.
-
Values:
index
-
global
boolean
required
-
Whether this Knowledge Base Entry is global, defaults to false.
-
name
string
required
-
Name of the Knowledge Base Entry.
-
namespace
string
required
-
Kibana Space, defaults to 'default' space.
-
users
object[]
required
-
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
-
-
createdAt
string
required
-
Time the Knowledge Base Entry was created.
-
createdBy
string
required
-
User who created the Knowledge Base Entry.
-
id
string · format: nonempty · min length: 1
required
-
A string that does not contain only whitespace characters.
-
updatedAt
string
required
-
Time the Knowledge Base Entry was last updated.
-
updatedBy
string
required
-
User who last updated the Knowledge Base Entry.
-
description
string
required
-
Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string
required
-
Field to query for Knowledge Base content.
-
index
string
required
-
Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string
required
-
Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
inputSchema
object[]
-
Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
-
-
description
string
required
-
Description of the field.
-
fieldName
string
required
-
Name of the field.
-
fieldType
string
required
-
Type of the field.
-
outputFields
string[]
-
Fields to extract from the query result, defaults to all fields if not provided or empty.
-
deleted
string[]
required
-
List of IDs of Knowledge Base Entries that were successfully deleted.
-
skipped
object[]
required
-
List of Knowledge Base Entries that were skipped during the bulk action.
-
-
id
string
required
-
ID of the skipped Knowledge Base Entry.
-
name
string
-
Name of the skipped Knowledge Base Entry.
-
skip_reason
enum
required
-
Reason why a Knowledge Base Entry was skipped during the bulk action.
-
Values:
KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
-
updated
union anyOf[]
required
-
List of Knowledge Base Entries that were successfully updated.
-
Same options as
created
in
results
-
summary
object
required
-
-
failed
integer
required
-
Number of Knowledge Base Entries that failed during the bulk action.
-
skipped
integer
required
-
Number of Knowledge Base Entries that were skipped during the bulk action.
-
succeeded
integer
required
-
Number of Knowledge Base Entries that were successfully processed during the bulk action.
-
total
integer
required
-
Total number of Knowledge Base Entries involved in the bulk action.
-
knowledgeBaseEntriesCount
integer
-
Total number of Knowledge Base Entries processed.
-
message
string
-
Message describing the result of the bulk action.
-
statusCode
integer
-
HTTP status code of the response.
-
success
boolean
-
Indicates whether the bulk action was successful.
-
error
string
required
-
Error type or category.
-
message
string
required
-
Detailed error message.
-
statusCode
number
required
-
HTTP status code of the error.