openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana Security Endpoint Management API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Interact with and manage endpoints running the Elastic Defend integration.
  name: Security Endpoint Management API
  x-displayName: Security endpoint management
paths:
  /api/endpoint/action:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all response actions.'
      operationId: EndpointGetActionsList
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
      - description: The number of response actions to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
      - description: A list of response action command names to filter by.
        in: query
        name: commands
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Commands'
      - description: A list of Elastic Agent IDs to filter the response actions by.
        in: query
        name: agentIds
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
      - description: A list of user IDs that submitted the response actions.
        in: query
        name: userIds
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_UserIds'
      - description: A start date in ISO 8601 format or Date Math format (for example, `now-24h`).
        in: query
        name: startDate
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_StartDate'
      - description: An end date in ISO 8601 format or Date Math format (for example, `now`).
        in: query
        name: endDate
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndDate'
      - description: The agent type to filter response actions by. Defaults to `endpoint`.
        in: query
        name: agentTypes
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
      - description: A list of response action IDs whose outputs should be included in the response.
        in: query
        name: withOutputs
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_WithOutputs'
      - description: A list of response action types to filter by (`automated`, `manual`).
        in: query
        name: types
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Types'
      responses:
        '200':
          content:
            application/json:
              examples:
                actionsList:
                  summary: A list of response actions
                  value:
                    data:
                    - agents:
                      - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                      agentType: endpoint
                      command: running-processes
                      completedAt: '2022-08-08T09:50:47.672Z'
                      createdBy: elastic
                      id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
                      isCompleted: true
                      isExpired: false
                      startedAt: '2022-08-08T15:24:57.402Z'
                      wasSuccessful: true
                    - agents:
                      - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                      agentType: endpoint
                      command: isolate
                      completedAt: '2022-08-08T10:41:57.352Z'
                      createdBy: elastic
                      id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
                      isCompleted: true
                      isExpired: false
                      startedAt: '2022-08-08T15:23:37.359Z'
                      wasSuccessful: true
                    elasticAgentIds:
                    - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                    endDate: now
                    page: 1
                    pageSize: 10
                    startDate: now-24h/h
                    total: 2
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_GetEndpointActionListResponse'
          description: Indicates a successful call.
      summary: Get response actions
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action_status:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action_status</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the status of response actions for the specified agent IDs.'
      operationId: EndpointGetActionsStatus
      parameters:
      - description: A list of agent IDs to get the action status for.
        in: query
        name: agent_ids
        required: true
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
      responses:
        '200':
          content:
            application/json:
              examples:
                actionStatus:
                  summary: Pending response actions per agent
                  value:
                    data:
                    - agent_id: afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                      pending_actions:
                        execute: 0
                        get-file: 0
                        isolate: 0
                        kill-process: 1
                        running-processes: 0
                        scan: 0
                        unisolate: 0
                        upload: 0
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStatusSuccessResponse'
          description: Indicates a successful call.
      summary: Get response actions status
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/{action_id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a response action using the action ID.'
      operationId: EndpointGetActionsDetails
      parameters:
      - description: The ID of the response action to retrieve.
        in: path
        name: action_id
        required: true
        schema:
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          maxLength: 256
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                actionDetails:
                  summary: Details of an isolate response action
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentType: endpoint
                      command: isolate
                      completedAt: '2022-08-08T10:41:57.352Z'
                      createdBy: elastic
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: true
                      isExpired: false
                      startedAt: '2022-08-08T15:23:37.359Z'
                      wasSuccessful: true
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionDetailsResponse'
          description: OK
      summary: Get action details
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/{action_id}/file/{file_id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get information for the specified response action file download.

        '
      operationId: EndpointFileInfo
      parameters:
      - description: The ID of the response action that generated the file.
        in: path
        name: action_id
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      - description: 'The file identifier is constructed in one of two ways:

          - For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:

          `{file_id}` = `{action_id}.{agent_id}`

          - For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.

          '
        in: path
        name: file_id
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                fileInfo:
                  summary: File information for a response action upload
                  value:
                    data:
                      actionId: 233db9ea-6733-4849-9226-5a7039c7161d
                      agentId: ed518850-681a-4d60-bb98-e22640cae2a8
                      agentType: endpoint
                      created: '2025-02-26T13:37:30.452Z'
                      id: 233db9ea-6733-4849-9226-5a7039c7161d.ed518850-681a-4d60-bb98-e22640cae2a8
                      mimeType: application/zip
                      name: memory_dump.zip
                      size: 1048576
                      status: READY
              schema:
                properties:
                  data:
                    type: object
                    properties:
                      actionId:
                        description: The response action ID.
                        type: string
                      agentId:
                        description: The agent ID that generated the file.
                        type: string
                      agentType:
                        description: The type of agent that generated the file.
                        type: string
                      created:
                        description: The date and time the file was created.
                        format: date-time
                        type: string
                      id:
                        description: The unique file identifier.
                        type: string
                      mimeType:
                        description: The MIME type of the file.
                        type: string
                      name:
                        description: The file name.
                        type: string
                      size:
                        description: The file size in bytes.
                        type: number
                      status:
                        description: The file upload status.
                        enum:
                        - AWAITING_UPLOAD
                        - UPLOADING
                        - READY
                        - UPLOAD_ERROR
                        - DELETED
                        type: string
          description: Indicates a successful call.
      summary: Get file information
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/{action_id}/file/{file_id}/download:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.

        > info

        > Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system''s password.

        '
      operationId: EndpointFileDownload
      parameters:
      - description: The ID of the response action that generated the file.
        in: path
        name: action_id
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      - description: 'The file identifier is constructed in one of two ways:

          - For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:

          `{file_id}` = `{action_id}.{agent_id}`

          - For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.

          '
        in: path
        name: file_id
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/octet-stream:
              examples:
                fileDownload:
                  summary: Password-protected ZIP archive containing the response action file
                  value: binary file content (password-protected .zip)
              schema:
                format: binary
                type: string
          description: Indicates a successful call.
      summary: Download a file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/cancel:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/cancel</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Cancel a running or pending response action (Applies only to some agent types).'
      operationId: CancelAction
      requestBody:
        content:
          application/json:
            examples:
              ElasticDefend:
                summary: Cancel a response action on an Elastic Defend host
                value:
                  agent_type: endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    force: true
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
              MicrosoftDefenderEndpoint:
                summary: Cancel a response action on a Microsoft Defender for Endpoint host
                value:
                  agent_type: microsoft_defender_endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CancelSuccess:
                  summary: Cancel action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: microsoft_defender_endpoint
                      command: cancel
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Cancel a response action
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/execute:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/execute</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Run a shell command on an endpoint.'
      operationId: EndpointExecuteAction
      requestBody:
        content:
          application/json:
            examples:
              executeCommand:
                summary: Execute a shell command on an endpoint
                value:
                  comment: Get list of all files
                  endpoint_ids:
                  - b3d6de74-36b0-4fa8-be46-c375bf1771bf
                  parameters:
                    command: ls -al
                    timeout: 600
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ExecuteRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ExecuteSuccess:
                  summary: Execute action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: execute
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 9f934028-2300-4927-b531-b26376793dc4
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        command: ls -al
                        timeout: 600
                      startedAt: '2023-07-28T18:43:27.362Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Run a command
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/get_file:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/get_file</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a file from an endpoint.'
      operationId: EndpointGetFileAction
      requestBody:
        content:
          application/json:
            examples:
              getFile:
                summary: Get a specific file from an endpoint
                value:
                  comment: Get my file
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFileRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                GetFileSuccess:
                  summary: Get file action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: get-file
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Get a file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/isolate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/isolate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Isolate an endpoint from the network. The endpoint remains isolated until it''s released.'
      operationId: EndpointIsolateAction
      requestBody:
        content:
          application/json:
            examples:
              multiple_endpoints:
                summary: Isolates several hosts; includes a comment
                value:
                  comment: Locked down, pending further investigation
                  endpoint_ids:
                  - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                  - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                  - fa89271b-b9d4-43f2-a684-307cffddeb5a
              single_endpoint:
                summary: Isolates a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
              with_case_id:
                summary: Isolates a single host with a case_id value of 1234
                value:
                  case_ids:
                  - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Isolating as initial response
                  endpoint_ids:
                  - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                  - b30a11bf-1395-4707-b508-fbb45ef9793e
            schema:
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
                  example:
                  - alert-id-1
                  - alert-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                case_ids:
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                  - case-id-1
                  - case-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
              required:
              - endpoint_ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                IsolateSuccess:
                  summary: Isolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: isolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_IsolateRouteResponse'
          description: Indicates a successful call.
      summary: Isolate an endpoint
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/kill_process:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/kill_process</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Terminate a running process on an endpoint.'
      operationId: EndpointKillProcessAction
      requestBody:
        content:
          application/json:
            examples:
              byEntityId:
                summary: Terminate a process by entity ID
                value:
                  comment: Terminating malicious process
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Terminate a process by PID
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcessRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                KillProcessSuccess:
                  summary: Kill process action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: kill-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Terminate a process
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/memory_dump:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/memory_dump</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Generates memory dumps on the targeted host.'
      operationId: EndpointGenerateMemoryDump
      requestBody:
        content:
          application/json:
            examples:
              ProcessMemoryDump:
                summary: Generate a memory dump from the host machine
                value:
                  agent_type: endpoint
                  comment: Generating memory dump for investigation
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
                    type: process
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDumpRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                MemoryDumpSuccessResponse:
                  summary: Memory dump action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: memory-dump
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                        type: process
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Generate a memory dump from the host machine
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/run_script:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/run_script</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Run a script on a host. Currently supported only for some agent types.'
      operationId: RunScriptAction
      requestBody:
        content:
          application/json:
            examples:
              Elastic Defend:
                description: Endpoint runscript to collect logs
                summary: Run a script against an Elastic Defend agent
                value:
                  agent_type: endpoint
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: --path= /usr/log/exec.log
              MDE:
                description: Microsoft Defender Endpoint runscript
                summary: Run a script against a Microsoft Defender Endpoint agent
                value:
                  agent_type: microsoft_defender_endpoint
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    args: -param1 value1 -param2 value2
                    scriptName: my-script.ps1
              SentinelOne:
                description: SentinelOne runscript
                summary: Run a script against a SentinelOne agent
                value:
                  agent_type: sentinel_one
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: --delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_RunScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                RunScriptSuccess:
                  summary: Run script action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: sentinel_one
                      command: runscript
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Run a script
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/running_procs:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/running_procs</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all processes running on an endpoint.'
      operationId: EndpointGetProcessesAction
      requestBody:
        content:
          application/json:
            examples:
              singleEndpoint:
                summary: Get running processes on a single endpoint
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetProcessesRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                RunningProcsSuccess:
                  summary: Running processes action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: running-processes
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Get running processes
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/scan:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/scan</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Scan a specific file or directory on an endpoint for malware.'
      operationId: EndpointScanAction
      requestBody:
        content:
          application/json:
            examples:
              scanFile:
                summary: Scan a file on an endpoint
                value:
                  comment: Scan the file for malware
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ScanRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ScanSuccess:
                  summary: Scan action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: scan
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Scan a file or directory
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/state:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/state</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a response actions state, which reports whether encryption is enabled.'
      operationId: EndpointGetActionsState
      responses:
        '200':
          content:
            application/json:
              examples:
                actionsState:
                  summary: Response actions state with encryption enabled
                  value:
                    data:
                      canEncrypt: true
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStateSuccessResponse'
          description: OK
      summary: Get actions state
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/suspend_process:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/suspend_process</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Suspend a running process on an endpoint.'
      operationId: EndpointSuspendProcessAction
      requestBody:
        content:
          application/json:
            examples:
              byEntityId:
                summary: Suspend a process by entity ID
                value:
                  comment: Suspending suspicious process
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Suspend a process by PID
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcessRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                SuspendProcessSuccess:
                  summary: Suspend process action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: suspend-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Suspend a process
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/unisolate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/unisolate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Release an isolated endpoint, allowing it to rejoin a network.'
      operationId: EndpointUnisolateAction
      requestBody:
        content:
          application/json:
            examples:
              multipleHosts:
                summary: 'Releases several hosts; includes a comment:'
                value:
                  comment: Benign process identified, releasing group
                  endpoint_ids:
                  - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                  - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                  - fa89271b-b9d4-43f2-a684-307cffddeb5a
              singleHost:
                summary: Releases a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
              withCaseId:
                summary: Releases hosts with an associated case; includes a comment.
                value:
                  case_ids:
                  - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Remediation complete, restoring network
                  endpoint_ids:
                  - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                  - b30a11bf-1395-4707-b508-fbb45ef9793e
            schema:
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
                  example:
                  - alert-id-1
                  - alert-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                case_ids:
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                  - case-id-1
                  - case-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
              required:
              - endpoint_ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UnisolateSuccess:
                  summary: Unisolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: unisolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_UnisolateRouteResponse'
          description: Indicates a successful call.
      summary: Release an isolated endpoint
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/upload:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/upload</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Upload a file to an endpoint.'
      operationId: EndpointUploadAction
      requestBody:
        content:
          multipart/form-data:
            examples:
              uploadFile:
                summary: Upload a script file to a specific endpoint
                value:
                  comment: Pushing remediation script to host
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  file: RWxhc3RpYw==
                  parameters:
                    overwrite: false
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_UploadRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UploadSuccess:
                  summary: Upload action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: upload
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: Host-5i6cuc8kdv
                      id: 9ff6aebc-2cb6-481e-8869-9b30036c9731
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        file_id: 10e4ce3d-4abb-4f93-a0cd-eaf63a489280
                        file_name: fix-malware.sh
                        file_sha256: a0bed94220193ba4895c0aa5b4e7e293381d15765cb164ddf7be5cdd010ae42a
                        file_size: 69
                      startedAt: '2023-07-03T15:07:22.837Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Upload a file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/metadata:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/metadata</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all endpoint host metadata.'
      operationId: GetEndpointMetadataList
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
      - description: The number of endpoints to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
      - description: A KQL string to filter the endpoint metadata results.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
      - description: A set of host statuses to filter the results by (for example, `healthy`, `updating`).
        in: query
        name: hostStatuses
        required: true
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_HostStatuses'
      - description: The field used to sort the results.
        in: query
        name: sortField
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_SortField'
      - description: The sort order, either `asc` or `desc`.
        in: query
        name: sortDirection
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
      responses:
        '200':
          content:
            application/json:
              examples:
                metadataList:
                  summary: A list of endpoint host metadata
                  value:
                    data:
                    - host_status: healthy
                      last_checkin: '2023-07-04T15:47:57.432Z'
                      metadata:
                        agent:
                          id: 285297c6-3bff-4b83-9a07-f3e749801123
                          type: endpoint
                          version: 8.10.0
                        Endpoint:
                          policy:
                            applied:
                              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                              name: test
                              status: success
                          status: enrolled
                        host:
                          hostname: WinDev2104Eval
                          os:
                            name: Windows
                            platform: windows
                            version: 20H2
                    page: 0
                    pageSize: 10
                    sortDirection: desc
                    sortField: enrolled_at
                    total: 1
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_MetadataListResponse'
          description: Indicates a successful call.
      summary: Get a metadata list
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/metadata/{id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/metadata/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get host metadata for a specific endpoint.'
      operationId: GetEndpointMetadata
      parameters:
      - description: The agent ID of the endpoint.
        in: path
        name: id
        required: true
        schema:
          example: ed518850-681a-4d60-bb98-e22640cae2a8
          maxLength: 256
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                endpointMetadata:
                  summary: Host metadata for a specific endpoint
                  value:
                    host_status: healthy
                    last_checkin: '2023-07-04T15:48:57.360Z'
                    metadata:
                      agent:
                        id: abb8a826-6812-448c-a571-6d8269b51449
                        type: endpoint
                        version: 8.10.0
                      Endpoint:
                        policy:
                          applied:
                            id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                            name: test
                            status: success
                        status: enrolled
                      host:
                        hostname: WinDev2104Eval
                        os:
                          name: Windows
                          platform: windows
                          version: 20H2
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointMetadataResponse'
          description: Indicates a successful call.
      summary: Get metadata
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/policy_response:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/policy_response</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the most recent policy response for an endpoint.'
      operationId: GetPolicyResponse
      parameters:
      - description: The agent ID to retrieve the policy response for.
        in: query
        name: agentId
        required: true
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
      responses:
        '200':
          content:
            application/json:
              examples:
                policyResponse:
                  summary: The most recent policy response for an endpoint
                  value:
                    policy_response:
                      '@timestamp': '2023-07-04T15:48:57.360Z'
                      agent:
                        id: ed518850-681a-4d60-bb98-e22640cae2a8
                        version: 7.16.0
                      Endpoint:
                        policy:
                          applied:
                            endpoint_policy_version: '2'
                            id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                            name: My endpoint policy
                            status: success
                            version: '3'
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_SuccessResponse'
          description: Indicates a successful call.
      summary: Get a policy response
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/protection_updates_note/{package_policy_id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the protection updates note for a package policy.'
      operationId: GetProtectionUpdatesNote
      parameters:
      - description: The package policy ID to retrieve the protection updates note for.
        in: path
        name: package_policy_id
        required: true
        schema:
          maxLength: 256
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                protectionUpdatesNote:
                  summary: The protection updates note for a package policy
                  value:
                    note: Pinned protection updates to 2025-01-01 while validating new signatures.
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
          description: Indicates a successful call.
      summary: Get a protection updates note
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create or update the protection updates note for a package policy.'
      operationId: CreateUpdateProtectionUpdatesNote
      parameters:
      - description: The package policy ID to create or update the protection updates note for.
        in: path
        name: package_policy_id
        required: true
        schema:
          maxLength: 256
          type: string
      requestBody:
        content:
          application/json:
            examples:
              setNote:
                summary: Set a new protection updates note
                value:
                  note: Pinned protection updates to 2025-01-01 while validating new signatures.
            schema:
              type: object
              properties:
                note:
                  description: The note content.
                  maxLength: 10000
                  type: string
              required:
              - note
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                noteSaved:
                  summary: Protection updates note saved
                  value:
                    note: Pinned protection updates to 2025-01-01 while validating new signatures.
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
          description: Indicates a successful call.
      summary: Create or update a protection updates note
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/scripts_library:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieve a list of scripts'
      operationId: EndpointScriptLibraryListScripts
      parameters:
      - description: Page number of the results to return. Defaults to 1.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
      - description: Number of results to return per page. Defaults to 10. Max value is 1000.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiPageSize'
      - description: The field to sort the results by. Defaults to name.
        in: query
        name: sortField
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiSortField'
      - description: The direction to sort the results by. Defaults to asc (ascending).
        in: query
        name: sortDirection
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
      - description: 'A KQL query string to filter the list of scripts. Nearly all fields in the script object are searchable.

          '
        in: query
        name: kuery
        required: false
        schema:
          allOf:
          - $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
          - example: platform:windows
      responses:
        '200':
          content:
            application/json:
              examples:
                response:
                  summary: List of scripts response example
                  value:
                    data: []
                    page: 1
                    pageSize: 10
                    sortDirection: asc
                    sortField: name
                    total: 100
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScript'
                    type: array
                  page:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
                  pageSize:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiPageSize'
                  sortDirection:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
                  sortField:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiSortField'
                  total:
                    description: The total number of scripts matching the query
                    type: integer
          description: List of scripts response
      summary: Get a list of scripts
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a new script entry by uploading a script file'
      operationId: EndpointScriptLibraryCreateScript
      requestBody:
        content:
          multipart/form-data:
            examples:
              CreateArchiveScriptEntry:
                summary: Create an archive script entry
                value:
                  description: Collects host data for investigation
                  example: ./collect_host_data.sh --help
                  file: ./collect_host_data.zip
                  fileType: archive
                  instructions: Collects host data for investigation
                  name: Collect host data
                  pathToExecutable: ./bin/collect_host_data.sh
                  platform:
                  - linux
                  - macos
                  requiresInput: false
              CreateScriptEntry:
                summary: Create a script entry
                value:
                  description: Collects host data for investigation
                  example: ./collect_host_data.sh --help
                  file: ./collect_host_data.sh
                  fileType: script
                  instructions: Collects host data for investigation
                  name: Collect host data
                  platform:
                  - linux
                  - macos
                  requiresInput: false
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CreateScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateScriptEntrySuccess:
                  summary: Create a script entry
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                      - linux
                      - macos
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
          description: Action request was successfully created
      summary: Create script
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/scripts_library/{script_id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a script'
      operationId: EndpointScriptLibraryDeleteScript
      parameters:
      - description: The ID of the script entry to be deleted.
        example: fr518850-681a-4y60-aa98-e22640cae2b8
        in: path
        name: script_id
        required: true
        schema:
          description: The ID of the script entry to be deleted.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          maxLength: 256
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                response:
                  summary: Delete script response example.
                  value: {}
              schema:
                type: object
          description: Delete script response.
      summary: Delete a script
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a script'
      operationId: EndpointScriptLibraryGetOneScript
      parameters:
      - description: The ID of the script entry.
        example: fr518850-681a-4y60-aa98-e22640cae2b8
        in: path
        name: script_id
        required: true
        schema:
          description: The ID of the script entry.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          maxLength: 256
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateScriptEntrySuccess:
                  summary: Get one script entry success
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                      - linux
                      - macos
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
          description: Get script response
      summary: Get script
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update (full or partial) a script entry'
      operationId: EndpointScriptLibraryPatchUpdateScript
      parameters:
      - description: The ID of the script entry to be updated.
        example: fr518850-681a-4y60-aa98-e22640cae2b8
        in: path
        name: script_id
        required: true
        schema:
          description: The ID of the script entry to be updated.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          maxLength: 256
          type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              PatchUpdateScriptEntry:
                summary: Update script entry instructions
                value:
                  instructions: ./collect_host_data.sh --help
              PatchUpdateScriptEntryFromArchiveToScript:
                summary: Update script entry from an archive to a script
                value:
                  fileType: script
              PatchUpdateScriptEntryToArchive:
                summary: Update script entry to be an archive
                value:
                  fileType: archive
                  pathToExecutable: ./bin/collect_host_data.sh
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PatchUpdateScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateScriptEntrySuccess:
                  summary: Update script entry success
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                      - linux
                      - macos
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
          description: Action request was successfully updated
      summary: Update script
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/scripts_library/{script_id}/download:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}/download</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Download a script file'
      operationId: EndpointScriptLibraryDownloadScript
      parameters:
      - description: The ID of the script entry.
        example: fr518850-681a-4y60-aa98-e22640cae2b8
        in: path
        name: script_id
        required: true
        schema:
          description: The ID of the script entry.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          maxLength: 256
          type: string
      responses:
        '200':
          content:
            application/octet-stream:
              examples:
                response:
                  summary: Download script file response example.
                  value: null
              schema:
                description: A download stream is returned.
                format: binary
                type: string
          description: Download script file response.
      summary: Download a script file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Endpoint_Management_API_Page:
      default: 1
      description: Page number
      example: 1
      minimum: 1
      type: integer
    Security_Endpoint_Management_API_Command:
      description: The command for the response action
      enum:
      - isolate
      - unisolate
      - kill-process
      - suspend-process
      - running-processes
      - get-file
      - execute
      - upload
      - scan
      - runscript
      - cancel
      - memory-dump
      minLength: 1
      type: string
    Security_Endpoint_Management_API_ElasticDefendCancelParameters:
      description: Elastic Defend agent type
      properties:
        force:
          description: Forcefully cancel the response action even when it is already running
          example: true
          type: boolean
        id:
          description: ID of the response action to cancel
          example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
          maxLength: 50
          minLength: 1
          type: string
      required:
      - id
      title: ElasticDefendCancelParameters
      type: object
    Security_Endpoint_Management_API_Isolate:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - description: Details of an isolate action response.
        type: object
    Security_Endpoint_Management_API_EndpointScriptFileType:
      description: The type of the uploaded file, which determines the expected value of `pathToExecutable`. If `fileType` is "script", then `pathToExecutable` should not be included. If `fileType` is "archive", then `pathToExecutable` is required and should specify the path to the executable file within the archive.
      enum:
      - script
      - archive
      type: string
    Security_Endpoint_Management_API_HostStatuses:
      description: A set of agent health statuses to filter by.
      example:
      - healthy
      - updating
      items:
        enum:
        - healthy
        - offline
        - updating
        - inactive
        - unenrolled
        type: string
      maxItems: 20
      type: array
    Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse:
      example:
        data:
          agents:
          - ed518850-681a-4d60-bb98-e22640cae2a8
          agentState:
            ed518850-681a-4d60-bb98-e22640cae2a8:
              isCompleted: false
              wasSuccessful: false
          agentType: __agent__type__here_
          command: __command__name__here__
          createdBy: elastic
          hosts:
            ed518850-681a-4d60-bb98-e22640cae2a8:
              name: gke-node-1235412
          id: 233db9ea-6733-4849-9226-5a7039c7161d
          isCompleted: false
          isExpired: false
          outputs: {}
          parameters: {}
          startedAt: '2022-07-29T19:08:49.126Z'
          status: pending
          wasSuccessful: false
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_Runscript:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  allOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                  - type: object
                    properties:
                      code:
                        type: string
                      stderr:
                        type: string
                      stdout:
                        type: string
            type: object
          parameters:
            oneOf:
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsCrowdStrike'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsMicrosoft'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsSentinelOne'
    Security_Endpoint_Management_API_DownloadUri:
      type: object
      properties:
        downloadUri:
          description: 'The server relative URI to download the file associated with the output of the response action.

            URI does **not** include the space prefix

            '
          example: /api/endpoint/action/497f6eca-6276/file/35645-6276-4993/download
          format: uri-reference
          type: string
    Security_Endpoint_Management_API_IsolateRouteResponse:
      type: object
      properties:
        action:
          description: The action ID (legacy field, same as `data.id`).
          type: string
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_Commands:
      description: A list of response action command names.
      example:
      - isolate
      - unisolate
      items:
        $ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
      maxItems: 50
      type: array
    Security_Endpoint_Management_API_ActionStatusSuccessResponse:
      type: object
      properties:
        data:
          description: One pending-actions summary entry per requested agent.
          items:
            type: object
            properties:
              agent_id:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
              pending_actions:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionsSchema'
            required:
            - agent_id
            - pending_actions
          type: array
      required:
      - data
    Security_Endpoint_Management_API_ScanRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              path:
                description: The folder or file's full path (including the file name).
                example: /usr/my-file.txt
                maxLength: 4096
                minLength: 1
                type: string
            required:
            - path
        required:
        - parameters
    Security_Endpoint_Management_API_ScriptNameSchema:
      description: Name of the script
      maxLength: 256
      minLength: 1
      type: string
    Security_Endpoint_Management_API_EndpointMetadataResponse:
      example:
        host_status: healthy
        last_checkin: '2023-07-04T15:48:57.360Z'
        metadata:
          '@timestamp': '2023-07-04T15:48:57.3609346Z'
          agent:
            build:
              original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
            id: abb8a826-6812-448c-a571-6d8269b51449
            type: endpoint
            version: 7.16.0
          data_stream:
            dataset: endpoint.metadata
            namespace: default
            type: metrics
          ecs:
            version: 1.11.0
          elastic:
            agent:
              id: abb8a826-6812-448c-a571-6d8269b51449
          Endpoint:
            capabilities:
            - isolation
            configuration:
              isolation: false
            policy:
              applied:
                endpoint_policy_version: '2'
                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                name: test
                status: success
                version: '3'
            state:
              isolation: false
            status: enrolled
          event:
            action: endpoint_metadata
            agent_id_status: verified
            category:
            - host
            created: '2023-07-04T15:48:57.3609346Z'
            dataset: endpoint.metadata
            id: MNtRc++KoKHXXwlj+++++OhZ
            ingested: '2023-07-04T15:48:58Z'
            kind: metric
            module: endpoint
            sequence: 43757
            type:
            - info
          host:
            architecture: x86_64
            hostname: WinDev2104Eval
            id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
            ip:
            - 10.0.2.15
            - fe80::21a6:63d3:d70e:e3ad
            - 127.0.0.1
            - ::1
            mac:
            - 08:00:27:b1:1d:5a
            name: WinDev2104Eval
            os:
              Ext:
                variant: Windows 10 Enterprise Evaluation
              family: windows
              full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
              kernel: 20H2 (10.0.19042.906)
              name: Windows
              platform: windows
              type: windows
              version: 20H2 (10.0.19042.906)
          message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
      type: object
      properties: {}
    Security_Endpoint_Management_API_SuspendProcessRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to suspend.
                  example: 123
                  minimum: 1
                  type: integer
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to suspend.
                  example: abc123
                  maxLength: 256
                  minLength: 1
                  type: string
        required:
        - parameters
    Security_Endpoint_Management_API_RawScriptParameters:
      type: object
      properties:
        commandLine:
          description: Command line arguments.
          maxLength: 8192
          minLength: 1
          type: string
        raw:
          description: Raw script content.
          maxLength: 65536
          minLength: 1
          type: string
        timeout:
          description: Timeout in seconds.
          minimum: 1
          type: integer
      required:
      - raw
    Security_Endpoint_Management_API_CloudFileScriptParameters:
      type: object
      properties:
        cloudFile:
          description: Script name in cloud storage.
          maxLength: 4096
          minLength: 1
          type: string
        commandLine:
          description: Command line arguments.
          maxLength: 8192
          minLength: 1
          type: string
        timeout:
          description: Timeout in seconds.
          minimum: 1
          type: integer
      required:
      - cloudFile
    Security_Endpoint_Management_API_MDERunScriptParameters:
      description: Parameters for Run Script response action against Microsoft Defender Endpoint agent type.
      example:
        agent_type: microsoft_defender_endpoint
        endpoint_ids:
        - endpoint-id-1
        parameters:
          args: -param1 value1 -param2 value2
          scriptName: my-script.ps1
      properties:
        args:
          description: Optional command line arguments for the script.
          maxLength: 8192
          minLength: 1
          type: string
        scriptName:
          description: The name of the script to execute from the cloud storage.
          maxLength: 256
          minLength: 1
          type: string
      required:
      - scriptName
      title: Microsoft Defender Endpoint Run Script Parameters
      type: object
    Security_Endpoint_Management_API_RunscriptParamsCrowdStrike:
      type: object
      properties:
        cloudFile:
          type: string
        commandLine:
          type: string
        hostPath:
          type: string
        raw:
          type: string
        timeout:
          type: number
    Security_Endpoint_Management_API_ActionDetailsResponse:
      discriminator:
        mapping:
          cancel: '#/components/schemas/Security_Endpoint_Management_API_Cancel'
          execute: '#/components/schemas/Security_Endpoint_Management_API_Execute'
          get-file: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
          isolate: '#/components/schemas/Security_Endpoint_Management_API_Isolate'
          kill-process: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
          memory-dump: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
          running-processes: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
          runscript: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
          scan: '#/components/schemas/Security_Endpoint_Management_API_Scan'
          suspend-process: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
          unisolate: '#/components/schemas/Security_Endpoint_Management_API_Unisolate'
          upload: '#/components/schemas/Security_Endpoint_Management_API_Upload'
        propertyName: command
      oneOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Execute'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Upload'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Scan'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Cancel'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Isolate'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Unisolate'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
    Security_Endpoint_Management_API_Comment:
      description: Optional comment
      example: This is a comment
      maxLength: 30000
      type: string
    Security_Endpoint_Management_API_EndpointRunScriptParameters:
      description: Parameters for Run Script response action against Elastic Defend agent type.
      example:
        agent_type: endpoint
        endpoint_ids:
        - endpoint-id-1
        parameters:
          scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
          scriptInput: --some-parameter some-value
      properties:
        scriptId:
          description: The script ID from the scripts library that will be executed.
          maxLength: 256
          minLength: 1
          type: string
        scriptInput:
          description: The input parameter arguments (if any) for the script that will be executed.
          maxLength: 8192
          minLength: 1
          type: string
      required:
      - scriptId
      title: Elastic Defend Run Script Parameters
      type: object
    Security_Endpoint_Management_API_AgentIds:
      description: A list of agent IDs. Max of 250.
      example:
      - agent-id-1
      - agent-id-2
      minLength: 1
      oneOf:
      - items:
          maxLength: 256
          minLength: 1
          type: string
        maxItems: 250
        minItems: 1
        type: array
      - maxLength: 256
        minLength: 1
        type: string
    Security_Endpoint_Management_API_GetProcessesRouteRequestBody:
      type: object
      properties:
        agent_type:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        alert_ids:
          description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
          example:
          - alert-id-1
          - alert-id-2
          items:
            maxLength: 256
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
        case_ids:
          description: The IDs of cases where the action taken will be logged. Max of 50.
          example:
          - case-id-1
          - case-id-2
          items:
            maxLength: 256
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
        comment:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
        endpoint_ids:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
        parameters:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
      required:
      - endpoint_ids
    Security_Endpoint_Management_API_PendingActionDataType:
      description: Number of pending actions of this type.
      type: integer
    Security_Endpoint_Management_API_RunningProcesses:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputEndpoint'
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne'
            type: object
    Security_Endpoint_Management_API_ApiPageSize:
      default: 10
      description: Number of items per page
      example: 10
      maximum: 1000
      minimum: 1
      type: integer
    Security_Endpoint_Management_API_SuccessResponse:
      description: A generic successful response.
      type: object
    Security_Endpoint_Management_API_RunscriptParamsSentinelOne:
      type: object
      properties:
        scriptId:
          type: string
        scriptInput:
          type: string
    Security_Endpoint_Management_API_KillProcessRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to terminate.
                  example: 123
                  minimum: 1
                  type: integer
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to terminate.
                  example: abc123
                  maxLength: 256
                  minLength: 1
                  type: string
            - type: object
              properties:
                process_name:
                  description: The name of the process to terminate. Valid for SentinelOne agent type only.
                  example: Elastic
                  maxLength: 1024
                  minLength: 1
                  type: string
        required:
        - parameters
    Security_Endpoint_Management_API_MDECancelParameters:
      description: Microsoft Defender for Endpoint agent type
      properties:
        id:
          description: ID of the response action to cancel
          example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
          maxLength: 50
          minLength: 1
          type: string
      required:
      - id
      title: MDECancelParameters
      type: object
    Security_Endpoint_Management_API_ArchivePathToExecutableSchema:
      description: Used only for when the uploaded script is an archive (.zip file for example). This property defines the relative path to the file included in the archive that should be executed once its contents are extracted. The path should be relative to the root of the archive.
      example: ./bin/script.sh
      maxLength: 4096
      type: string
    Security_Endpoint_Management_API_GetFile:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  allOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                  - type: object
                    properties:
                      code:
                        type: string
                      contents:
                        items:
                          type: object
                          properties:
                            file_name:
                              type: string
                            path:
                              type: string
                            sha256:
                              type: string
                            size:
                              type: number
                            type:
                              type: string
                        type: array
                      zip_size:
                        type: number
            type: object
          parameters:
            type: object
            properties:
              path:
                type: string
    Security_Endpoint_Management_API_CreateScriptRouteRequestBody:
      type: object
      properties:
        description:
          description: Description of the script and its purpose/functionality
          maxLength: 10000
          type: string
        example:
          description: Example usage of the script
          maxLength: 10000
          type: string
        file:
          description: The script file upload
          format: binary
          type: object
        fileType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptFileType'
        instructions:
          description: Instructions for using the script, including details around its supported input arguments
          maxLength: 10000
          type: string
        name:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptNameSchema'
        pathToExecutable:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ArchivePathToExecutableSchema'
        platform:
          description: Platforms supported by the the script
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform'
          type: array
        requiresInput:
          description: Whether the script requires input arguments
          type: boolean
        tags:
          description: Tags to categorize the script
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags'
          type: array
      required:
      - name
      - platform
      - file
      - fileType
    Security_Endpoint_Management_API_UnisolateRouteResponse:
      type: object
      properties:
        action:
          description: The action ID (legacy field, same as `data.id`).
          type: string
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_HostPathScriptParameters:
      type: object
      properties:
        commandLine:
          description: Command line arguments.
          maxLength: 8192
          minLength: 1
          type: string
        hostPath:
          description: Absolute or relative path of script on host machine.
          maxLength: 4096
          minLength: 1
          type: string
        timeout:
          description: Timeout in seconds.
          minimum: 1
          type: integer
      required:
      - hostPath
    Security_Endpoint_Management_API_RunningProcessesOutputEndpoint:
      description: Processes output for `agentType` of `endpoint`
      type: object
      properties:
        code:
          type: string
        entries:
          items:
            type: object
            properties:
              command:
                type: string
              entity_id:
                type: string
              pid:
                type: number
              user:
                type: string
          type: array
    Security_Endpoint_Management_API_MemoryDumpRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - description: Dump the entire kernel memory.
              type: object
              properties:
                type:
                  enum:
                  - kernel
                  type: string
              required:
              - type
            - description: Dump the entire memory of a process using the PID.
              type: object
              properties:
                pid:
                  type: number
                type:
                  enum:
                  - process
                  type: string
              required:
              - type
              - pid
            - description: Dump the entire memory of a process using the entity ID.
              type: object
              properties:
                entity_id:
                  maxLength: 256
                  minLength: 1
                  type: string
                type:
                  enum:
                  - process
                  type: string
              required:
              - type
              - entity_id
        required:
        - parameters
    Security_Endpoint_Management_API_Parameters:
      description: Parameters object
      type: object
    Security_Endpoint_Management_API_SortField:
      description: Determines which field is used to sort the results.
      enum:
      - enrolled_at
      - metadata.host.hostname
      - host_status
      - metadata.Endpoint.policy.applied.name
      - metadata.Endpoint.policy.applied.status
      - metadata.host.os.name
      - metadata.host.ip
      - metadata.agent.version
      - last_checkin
      example: enrolled_at
      type: string
    Security_Endpoint_Management_API_Execute:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  allOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                  - type: object
                    properties:
                      code:
                        type: string
                      cwd:
                        type: string
                      output_file_id:
                        type: string
                      output_file_stderr_truncated:
                        type: boolean
                      output_file_stdout_truncated:
                        type: boolean
                      shell_code:
                        type: number
                      stderr:
                        type: string
                      stderr_truncated:
                        type: boolean
                      stdout:
                        type: string
                      stdout_truncated:
                        type: boolean
            type: object
          parameters:
            type: object
            properties:
              command:
                type: string
              timeout:
                type: number
    Security_Endpoint_Management_API_ScriptsApiResponse:
      example:
        data:
          description: Collects host data for investigation
          downloadUri: /api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download
          example: ./collect_host_data.sh --help
          fileHash: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
          fileName: collect_host_data.sh
          fileSize: 12345
          id: 123e4567-e89b-12d3-a456-426655440000
          instructions: Collects host data for investigation
          name: Collect host data
          platform:
          - linux
          - macos
          requiresInput: false
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScript'
    Security_Endpoint_Management_API_MemoryDump:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  properties:
                    code:
                      type: string
                    disk_free_space:
                      description: The free space on the host machine in bytes after the memory dump is written to disk
                      type: number
                    file_size:
                      description: The size of the memory dump compressed file in bytes
                      type: string
                    path:
                      description: The path to the memory dump compressed file on the host machine
                      type: string
                  title: Memory dump output
                  type: object
            type: object
          parameters:
            oneOf:
            - properties:
                type:
                  description: Kernel-level memory dump
                  enum:
                  - kernel
                  type: string
              required:
              - type
              title: Kernel memory dump
              type: object
            - properties:
                pid:
                  description: The process ID (PID)
                  type: number
                type:
                  description: Process-level memory dump using a process ID
                  enum:
                  - process
                  type: string
              required:
              - type
              - pid
              title: Process memory dump with PID
              type: object
            - properties:
                entity_id:
                  description: The process entity ID
                  type: string
                type:
                  description: Process-level memory dump using an entity ID
                  enum:
                  - process
                  type: string
              required:
              - type
              - entity_id
              title: Process memory dump with entity ID
              type: object
        required:
        - parameters
    Security_Endpoint_Management_API_UploadRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          file:
            description: The binary content of the file.
            example: RWxhc3RpYw==
            format: binary
            type: string
          parameters:
            type: object
            properties:
              overwrite:
                default: false
                description: Overwrite the file on the host if it already exists.
                example: false
                type: boolean
        required:
        - parameters
        - file
    Security_Endpoint_Management_API_EndDate:
      description: An end date in ISO format or Date Math format.
      example: '2023-10-31T23:59:59.999Z'
      maxLength: 64
      type: string
    Security_Endpoint_Management_API_EndpointScriptPlatform:
      enum:
      - linux
      - macos
      - windows
      type: string
    Security_Endpoint_Management_API_GetFileRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              path:
                description: The full file path to retrieve from the endpoint.
                maxLength: 4096
                minLength: 1
                type: string
            required:
            - path
        required:
        - parameters
    Security_Endpoint_Management_API_RunScriptRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            description: 'One of the following set of parameters must be provided for the `agentType` that is specified.

              '
            oneOf:
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointRunScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RawScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_HostPathScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_CloudFileScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_SentinelOneRunScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_MDERunScriptParameters'
        required:
        - parameters
    Security_Endpoint_Management_API_Type:
      description: Type of response action
      enum:
      - automated
      - manual
      type: string
    Security_Endpoint_Management_API_SuspendProcess:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  oneOf:
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      pid:
                        type: number
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      entity_id:
                        type: string
            type: object
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to terminate.
                  minimum: 1
                  type: number
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to terminate.
                  minLength: 1
                  type: string
    Security_Endpoint_Management_API_AgentTypes:
      description: List of agent types to retrieve. Defaults to `endpoint`.
      enum:
      - endpoint
      - sentinel_one
      - crowdstrike
      - microsoft_defender_endpoint
      example: endpoint
      type: string
    Security_Endpoint_Management_API_UserIds:
      description: A list of user IDs. Max of 50.
      example:
      - user-id-1
      - user-id-2
      oneOf:
      - items:
          maxLength: 256
          minLength: 1
          type: string
        maxItems: 50
        minItems: 1
        type: array
      - maxLength: 256
        minLength: 1
        type: string
    Security_Endpoint_Management_API_ActionStateSuccessResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            canEncrypt:
              description: Whether the Kibana instance has encryption enabled for response actions.
              type: boolean
      required:
      - data
    Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
      - description: Processes output for `agentType` of `sentinel_one`
        type: object
        properties:
          code:
            type: string
    Security_Endpoint_Management_API_EndpointScript:
      type: object
      properties:
        createdAt:
          format: date-time
          type: string
        createdBy:
          example: elastic
          type: string
        description:
          description: Description of the script and its purpose/functionality
          example: Collects host data for investigation
          type: string
        downloadUri:
          description: URI to download the script file. Note that this is the relative path and does not include the space (if applicable)
          example: /api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download
          type: string
        example:
          type: string
        fileHash:
          description: SHA256 hash of the script file that was uploaded
          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
          type: string
        fileName:
          description: Name of the script file that was uploaded
          example: collect_host_data.sh
          type: string
        fileSize:
          description: Size of the script file that was uploaded in bytes
          example: 12345
          type: integer
        id:
          example: 123e4567-e89b-12d3-a456-426655440000
          format: uuid
          type: string
        instructions:
          description: Instructions for using the script, including details around its supported input arguments
          type: string
        name:
          example: Collect host data
          type: string
        pathToExecutable:
          description: 'The relative path to the file included in the archive that should be executed once its contents are extracted. Applicable only for scripts uploaded as an archive (.zip file for example).

            '
          type: string
        platform:
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform'
          type: array
        requiresInput:
          type: boolean
        tags:
          description: Tags that categorize the script
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags'
          type: array
        updatedAt:
          format: date-time
          type: string
        updatedBy:
          example: admin
          type: string
        version:
          type: string
    Security_Endpoint_Management_API_ResponseActionDetails:
      type: object
      properties:
        agents:
          description: The agent IDs for the hosts that the response action was sent to
          items:
            format: uuid
            type: string
          type: array
        agentState:
          additionalProperties:
            format: uuid
            type: object
            properties:
              completedAt:
                description: The date and time the response action was completed for the agent ID
                type: string
              isCompleted:
                description: Whether the response action is completed for the agent ID
                type: boolean
              wasCanceled:
                description: Whether the response action was canceled for the agent ID
                type: boolean
              wasSuccessful:
                description: Whether the response action was successful for the agent ID
                type: boolean
          description: The state of the response action for each agent ID that it was sent to
          type: object
        agentType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        command:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
        completedAt:
          description: The response action completion time
          format: date-time
          type: string
        createdBy:
          description: The user who created the response action
          type: string
        hosts:
          additionalProperties:
            format: uuid
            type: object
            properties:
              name:
                description: The host name
                type: string
          description: An object containing the host names associated with the agent IDs the response action was sent to
          type: object
        id:
          description: The response action ID
          format: uuid
          type: string
        isComplete:
          description: Whether the response action is complete
          type: boolean
        isExpired:
          description: Whether the response action is expired
          type: boolean
        outputs:
          additionalProperties:
            description: The agent id
            format: uuid
            properties:
              content:
                description: The response action output content for the agent ID. Exact format depends on the response action command.
                oneOf:
                - type: object
                - type: string
              type:
                enum:
                - json
                - text
                type: string
            required:
            - type
            - content
            title: Agent ID
            type: object
          description: 'The outputs of the response action for each agent ID that it was sent to. Content different depending on the

            response action command and will only be present for agents that have responded to the response action

            '
          type: object
        parameters:
          description: The parameters of the response action. Content different depending on the response action command
          type: object
        startedAt:
          description: The response action start time
          format: date-time
          type: string
        status:
          description: The response action status
          type: string
        wasCanceled:
          description: Whether the response action was canceled
          type: boolean
        wasSuccessful:
          description: Whether the response action was successful
          type: boolean
      required:
      - command
    Security_Endpoint_Management_API_CancelRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_ElasticDefendCancelParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_MDECancelParameters'
        required:
        - parameters
    Security_Endpoint_Management_API_GetEndpointActionListResponse:
      example:
        data:
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: running-processes
          completedAt: '2022-08-08T09:50:47.672Z'
          createdBy: elastic
          id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T15:24:57.402Z'
          wasSuccessful: true
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: isolate
          completedAt: '2022-08-08T10:41:57.352Z'
          createdBy: elastic
          id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T15:23:37.359Z'
          wasSuccessful: true
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: kill-process
          comment: bad process - taking up too much cpu
          completedAt: '2022-08-08T09:44:50.952Z'
          createdBy: elastic
          id: 5bc92c86-b8e6-42dd-837f-12ad29e09caa
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T14:38:44.125Z'
          wasSuccessful: true
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: unisolate
          comment: Not a threat to the network
          completedAt: '2022-08-08T09:40:47.398Z'
          createdBy: elastic
          id: 790d54e0-3aa3-4e5b-8255-3ce9d851246a
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T14:38:15.391Z'
          wasSuccessful: true
        elasticAgentIds:
        - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
        endDate: now
        page: 1
        pageSize: 10
        startDate: now-24h/h
        total: 4
      type: object
      properties:
        agentTypes:
          description: The list of agent types the query was filtered by.
          items:
            type: string
          type: array
        commands:
          description: The list of commands the query was filtered by.
          items:
            type: string
          type: array
        data:
          description: The list of response actions.
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
          type: array
        elasticAgentIds:
          description: The list of elastic agent IDs the query was filtered by.
          items:
            type: string
          type: array
        endDate:
          description: The end date filter applied to the query.
          type: string
        page:
          description: The current page number.
          type: integer
        pageSize:
          description: The number of items per page.
          type: integer
        startDate:
          description: The start date filter applied to the query.
          type: string
        statuses:
          description: The list of statuses the query was filtered by.
          items:
            type: string
          type: array
        total:
          description: The total number of response actions matching the query.
          type: integer
        userIds:
          description: The list of user IDs the query was filtered by.
          items:
            type: string
          type: array
    Security_Endpoint_Management_API_RunscriptParamsMicrosoft:
      type: object
      properties:
        args:
          type: string
        scriptName:
          type: string
    Security_Endpoint_Management_API_SortDirection:
      description: Determines the sort order.
      enum:
      - asc
      - desc
      example: desc
      type: string
    Security_Endpoint_Management_API_WithOutputs:
      description: A list of action IDs that should include the complete output of the action. Max of 50.
      example:
      - action-id-1
      - action-id-2
      oneOf:
      - items:
          maxLength: 256
          minLength: 1
          type: string
        maxItems: 50
        minItems: 1
        type: array
      - maxLength: 256
        minLength: 1
        type: string
    Security_Endpoint_Management_API_KillProcess:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  oneOf:
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      pid:
                        type: number
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      entity_id:
                        type: string
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      process_name:
                        type: string
            type: object
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to terminate.
                  minimum: 1
                  type: number
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to terminate.
                  minLength: 1
                  type: string
            - type: object
              properties:
                process_name:
                  description: The name of the process to terminate. Valid for SentinelOne agent type only.
                  type: string
    Security_Endpoint_Management_API_SentinelOneRunScriptParameters:
      description: Parameters for Run Script response action against SentinelOne agent type.
      example:
        agent_type: sentinel_one
        endpoint_ids:
        - endpoint-id-1
        parameters:
          scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
          scriptInput: --delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt
      properties:
        scriptId:
          description: The script ID from SentinelOne scripts library that will be executed.
          maxLength: 256
          minLength: 1
          type: string
        scriptInput:
          description: The input parameter arguments for the script that was selected.
          maxLength: 8192
          minLength: 1
          type: string
      required:
      - scriptId
      title: SentinelOne Run Script Parameters
      type: object
    Security_Endpoint_Management_API_ApiSortField:
      description: Determines which field is used to sort the results.
      enum:
      - name
      - createdAt
      - createdBy
      - updatedAt
      - updatedBy
      - fileSize
      example: updatedAt
      type: string
    Security_Endpoint_Management_API_Cancel:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  type: object
                  properties:
                    code:
                      type: string
            type: object
          parameters:
            type: object
            properties:
              id:
                format: uuid
                type: string
    Security_Endpoint_Management_API_PageSize:
      default: 10
      description: Number of items per page
      example: 10
      maximum: 100
      minimum: 1
      type: integer
    Security_Endpoint_Management_API_EndpointIds:
      description: List of endpoint IDs (cannot contain empty strings). Max of 250.
      example:
      - endpoint-id-1
      - endpoint-id-2
      items:
        maxLength: 256
        minLength: 1
        type: string
      maxItems: 250
      minItems: 1
      type: array
    Security_Endpoint_Management_API_Kuery:
      description: A KQL string.
      example: 'united.endpoint.host.os.name : ''Windows'''
      maxLength: 30000
      type: string
    Security_Endpoint_Management_API_Unisolate:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - description: Details of an unisolate action response.
        type: object
    Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse:
      type: object
      properties:
        note:
          description: A note associated with the protection updates for the given package policy.
          type: string
    Security_Endpoint_Management_API_AgentId:
      description: Agent ID
      maxLength: 256
      type: string
    Security_Endpoint_Management_API_ExecuteRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              maxLength: 256
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              command:
                description: The shell command to execute on the endpoint.
                maxLength: 8192
                minLength: 1
                type: string
              timeout:
                description: The maximum timeout value in seconds before the command is terminated.
                minimum: 1
                type: integer
            required:
            - command
        required:
        - parameters
    Security_Endpoint_Management_API_Upload:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  type: object
                  properties:
                    code:
                      type: string
                    disk_free_space:
                      type: number
                    path:
                      type: string
            type: object
          parameters:
            description: 'The parameters for upload returned on the details are derived via the API from the file that

              was uploaded at the time that the response action was submitted

              '
            type: object
            properties:
              file_id:
                type: string
              file_name:
                type: string
              file_sha256:
                type: string
              file_size:
                type: number
    Security_Endpoint_Management_API_MetadataListResponse:
      example:
        data:
        - host_status: healthy
          last_checkin: '2023-07-04T15:47:57.432Z'
          metadata:
            '@timestamp': '2023-07-04T15:47:57.432173535Z'
            agent:
              build:
                original: 'version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
              id: 285297c6-3bff-4b83-9a07-f3e749801123
              type: endpoint
              version: 7.16.0
            data_stream:
              dataset: endpoint.metadata
              namespace: default
              type: metrics
            ecs:
              version: 1.11.0
            elastic:
              agent:
                id: 285297c6-3bff-4b83-9a07-f3e749801123
            Endpoint:
              capabilities:
              - isolation
              configuration:
                isolation: false
              policy:
                applied:
                  endpoint_policy_version: '2'
                  id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                  name: test
                  status: success
                  version: '3'
              state:
                isolation: false
              status: enrolled
            event:
              action: endpoint_metadata
              agent_id_status: verified
              category:
              - host
              created: '2023-07-04T15:47:57.432173535Z'
              dataset: endpoint.metadata
              id: MNtSXK/SkhEBnmgt++++++7S
              ingested: '2023-07-04T15:47:58Z'
              kind: metric
              module: endpoint
              sequence: 400
              type:
              - info
            host:
              architecture: x86_64
              hostname: david-Xubuntu
              id: 0cfead88e2024bd8a27476352b5ab264
              ip:
              - 127.0.0.1
              - ::1
              - 10.0.2.15
              - fe80::2ac7:8e15:b957:2fa1
              mac:
              - 08:00:27:e6:78:8b
              name: david-Xubuntu
              os:
                Ext:
                  variant: Ubuntu
                family: ubuntu
                full: Ubuntu 20.04.2
                kernel: '5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021'
                name: Linux
                platform: ubuntu
                type: linux
                version: 20.04.2
            message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 0
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
        - host_status: healthy
          last_checkin: '2023-07-04T15:44:31.491Z'
          metadata:
            '@timestamp': '2023-07-04T15:44:31.4917849Z'
            agent:
              build:
                original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
              id: abb8a826-6812-448c-a571-6d8269b51449
              type: endpoint
              version: 7.16.0
            data_stream:
              dataset: endpoint.metadata
              namespace: default
              type: metrics
            ecs:
              version: 1.11.0
            elastic:
              agent:
                id: abb8a826-6812-448c-a571-6d8269b51449
            Endpoint:
              capabilities:
              - isolation
              configuration:
                isolation: false
              policy:
                applied:
                  endpoint_policy_version: '2'
                  id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                  name: test
                  status: success
                  version: '3'
              state:
                isolation: false
              status: enrolled
            event:
              action: endpoint_metadata
              agent_id_status: verified
              category:
              - host
              created: '2023-07-04T15:44:31.4917849Z'
              dataset: endpoint.metadata
              id: MNtRc++KoKHXXwlj+++++/N9
              ingested: '2023-07-04T15:44:33Z'
              kind: metric
              module: endpoint
              sequence: 5159
              type:
              - info
            host:
              architecture: x86_64
              hostname: WinDev2104Eval
              id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
              ip:
              - 10.0.2.15
              - fe80::21a6:63d3:d70e:e3ad
              - 127.0.0.1
              - ::1
              mac:
              - 08:00:27:b1:1d:5a
              name: WinDev2104Eval
              os:
                Ext:
                  variant: Windows 10 Enterprise Evaluation
                family: windows
                full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
                kernel: 20H2 (10.0.19042.906)
                name: Windows
                platform: windows
                type: windows
                version: 20H2 (10.0.19042.906)
            message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 0
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
        page: 0
        pageSize: 10
        sortDirection: desc
        sortField: enrolled_at
        total: 2
      type: object
      properties: {}
    Security_Endpoint_Management_API_StartDate:
      description: A start date in ISO 8601 format or Date Math format.
      example: '2023-10-31T00:00:00.000Z'
      maxLength: 64
      type: string
    Security_Endpoint_Management_API_PendingActionsSchema:
      oneOf:
      - type: object
        properties:
          execute:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending execute actions.
          get-file:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending get-file actions.
          isolate:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending isolate actions.
          kill-process:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending kill-process actions.
          running-processes:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending running-processes (get processes) actions.
          scan:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending scan actions.
          suspend-process:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending suspend-process actions.
          unisolate:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending unisolate (release) actions.
          upload:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending upload actions.
      - additionalProperties: true
        type: object
    Security_Endpoint_Management_API_EndpointScriptTags:
      enum:
      - remediationAction
      - dataCollection
      - networkDiagnostics
      - networkAction
      - systemInventory
      - forensicCollection
      - threatHunting
      - discovery
      - systemManagement
      - userManagement
      - troubleshooting
      type: string
    Security_Endpoint_Management_API_Scan:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  type: object
                  properties:
                    code:
                      type: string
            type: object
          parameters:
            type: object
            properties:
              path:
                type: string
    Security_Endpoint_Management_API_PatchUpdateScriptRouteRequestBody:
      description: The script entry properties to be updated. At least one property must be provided.
      minProperties: 1
      type: object
      properties:
        description:
          description: Description of the script and its purpose/functionality
          maxLength: 10000
          type: string
        example:
          description: Example usage of the script
          maxLength: 10000
          type: string
        file:
          description: The script file upload
          format: binary
          type: object
        fileType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptFileType'
        instructions:
          description: Instructions for using the script, including details around its supported input arguments
          maxLength: 10000
          type: string
        name:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptNameSchema'
        pathToExecutable:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ArchivePathToExecutableSchema'
        platform:
          description: Platforms supported by the the script
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform'
          type: array
        requiresInput:
          description: Whether the script requires input arguments
          type: boolean
        tags:
          description: Tags to categorize the script
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags'
          type: array
        version:
          description: Version of the script
          maxLength: 256
          minLength: 1
          type: string
    Security_Endpoint_Management_API_Types:
      description: List of types of response actions
      example:
      - automated
      - manual
      items:
        $ref: '#/components/schemas/Security_Endpoint_Management_API_Type'
      maxLength: 2
      minLength: 1
      type: array
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"