slug: kibana provider: Kibana generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 14 edges: - tag: Security Detections API spec_file: kibana-security-detections-api-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.92 evidence: POST /api/detection_engine/rules CreateRule Create a detection rule; DELETE /api/detection_engine/index DeleteAlertsIndex Delete an alerts index reason: Detection engine rule lifecycle and security alert index management — this is SIEM detection content management, i.e. threat detection and response. - tag: Security Attack discovery API spec_file: kibana-security-attack-discovery-api-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.9 evidence: POST /api/attack_discovery/_generate PostAttackDiscoveryGenerate Generate attack discoveries from alerts reason: Operations generate, schedule and triage attack discoveries derived from security alerts — squarely SOC/SIEM threat detection and response. - tag: Security Endpoint Management API spec_file: kibana-security-endpoint-management-api-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.9 evidence: POST /api/endpoint/action/isolate EndpointIsolateAction Isolate an endpoint; POST /api/endpoint/action/kill_process EndpointKillProcessAction Terminate a process reason: Endpoint response actions (isolate host, kill process, memory dump, run script) are classic incident response containment operations under Threat Detection & Response. - tag: roles spec_file: kibana-roles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: PUT /api/security/role/{name} Create or update a role; Kibana_HTTP_APIs_security_role_indices_privileges reason: Security role and privilege CRUD — access control administration, clearly Identity & Access Management. - tag: slo spec_file: kibana-slo-api-openapi.yml capability_id: BC-4220.10 capability_id_l1: BC-4220 capability_name: Service Reliability Engineering confidence: 0.85 evidence: POST /s/{spaceId}/api/observability/slos createSloOp Create an SLO; SLOs_budgeting_method reason: Operations create and manage service-level objectives with budgeting methods (error budgets) for observability — this is Service Reliability Engineering (SLI/SLO/error budget stewardship). - tag: synthetics spec_file: kibana-synthetics-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: POST /api/synthetics/monitor/test/{monitorId} Trigger an on-demand test run for a monitor; Synthetics_browserMonitorFields reason: Creates and runs synthetic monitors (HTTP, TCP, ICMP, browser) against services — explicitly synthetic monitoring under Observability Management. - tag: Security spec_file: kibana-security-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST /api/security/role/_query — 'Query roles'; schema Kibana_HTTP_APIs_security_query_roles_filters reason: The operation queries Kibana security roles, i.e. inspection of role-based access control definitions, which sits in Identity & Access Management. Only one read operation is exposed, hence 0.8 rather than higher. - tag: Security Timeline API spec_file: kibana-security-timeline-api-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.78 evidence: POST /api/timeline CreateTimelines Create a Timeline or Timeline template; PATCH /api/pinned_event PersistPinnedEventRoute Pin/unpin an event reason: Security Timelines with notes and pinned events are the investigation workspace of the Elastic SIEM — analyst case investigation under Threat Detection & Response. - tag: APM agent configuration spec_file: kibana-apm-agent-configuration-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.75 evidence: PUT /api/apm/settings/agent-configuration createUpdateAgentConfiguration Create or update agent configuration; GET /api/apm/settings/agent-configuration/agent_name Get agent name for service reason: Configures APM (application performance monitoring) agents per service and environment — instrumentation/monitoring configuration for running services, i.e. observability management on this observability vendor's platform. - tag: alerting spec_file: kibana-alerting-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.75 evidence: POST /api/alerting/rule/{id} Create a rule; Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting reason: Alerting rules on CPU usage, disk usage, APM error rate — infrastructure/service monitoring, not financial-crime or business alerting. Maps to observability/monitoring; sub-capability choice between Observability Management and Incident Response is somewhat ambiguous. - tag: Security Entity Analytics API spec_file: kibana-security-entity-analytics-api-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.72 evidence: POST /api/asset_criticality CreateAssetCriticalityRecord Upsert an asset criticality record; POST /api/entity_analytics/monitoring/engine/init InitMonitoringEngine Initialize the Privilege Monitoring Engine reason: Security entity risk scoring, asset criticality and privileged-user monitoring. Clearly cybersecurity, but it straddles identity/privilege monitoring (BC-620.20) and risk-based detection (BC-620.30), so only the L1 is asserted. - tag: Elastic Agents spec_file: kibana-elastic-agents-api-openapi.yml capability_id: BC-600.40 capability_id_l1: BC-600 capability_name: IT Operations Management confidence: 0.7 evidence: GET /api/fleet/agents Get agents; POST /api/fleet/agents/{agentId}/migrate Migrate a single agent reason: Full inventory and lifecycle management of deployed Elastic Agents (list, update, migrate, privilege level, available versions, uploads) — operational management of monitoring infrastructure agents, an IT Operations capability. - tag: cases spec_file: kibana-cases-api-openapi.yml capability_id: BC-4220.30 capability_id_l1: BC-4220 capability_name: Incident Response Management confidence: 0.7 evidence: POST /api/cases Create a case; GET /api/cases/{caseId}/alerts Get all alerts for a case reason: Cases group alerts with comments and assignees for investigation of production/security issues in an observability platform — closest fit is incident response management. Could also be read as IT Service Management; moderate confidence. - tag: user session spec_file: kibana-user-session-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /api/security/session/_invalidate Invalidate user sessions reason: Session invalidation is an access-management administrative control, mapping to Identity & Access Management; thin single-operation surface so moderate confidence.