langSmithProject: security_ai_project
messages:
- content: What are some common phishing techniques?
data:
user_id: user_789
fields_to_anonymize:
- user.name
- source.ip
role: user
model: gpt-4
persist: true
promptId: prompt_456
responseLanguage: en
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatCompleteProps'
required: true
responses:
'200':
content:
application/octet-stream:
examples:
ChatCompleteResponse200Example:
value: (streaming binary response)
schema:
format: binary
type: string
description: Indicates a successful model response call.
'400':
content:
application/json:
examples:
ChatCompleteResponse400Example:
value:
error: Bad Request
message: Invalid request payload.
statusCode: 400
schema:
type: object
properties:
error:
description: Error type.
example: Bad Request
type: string
message:
description: Human-readable error message.
example: Invalid request payload.
type: string
statusCode:
description: HTTP status code.
example: 400
type: number
description: Bad Request response.
summary: Create a model response
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/chat/complete' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"connectorId\":\"conn-001\",\"persist\":true,\"messages\":[{\"role\":\"user\",\"content\":\"What are common phishing techniques?\"}]}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/current_user/conversations:
delete:
description: '**Spaces method and path for this operation:**
delete /s/{space_id}/api/security_ai_assistant/current_user/conversations
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
This endpoint allows users to permanently delete all conversations.'
operationId: DeleteAllConversations
requestBody:
content:
application/json:
examples:
DeleteAllConversationsRequest:
value:
excludedIds:
- abc123
- def456
schema:
type: object
properties:
excludedIds:
description: Optional list of conversation IDs to delete.
example:
- abc123
- def456
items:
type: string
type: array
required: false
responses:
'200':
content:
application/json:
examples:
DeleteAllConversationsResponse200Example:
value:
failures: []
success: true
totalDeleted: 10
schema:
type: object
properties:
failures:
items:
type: string
type: array
success:
example: true
type: boolean
totalDeleted:
example: 10
type: number
description: Indicates a successful call. The conversations were deleted successfully.
'400':
content:
application/json:
examples:
DeleteAllConversationsResponse400Example:
value:
error: Bad Request
message: Invalid conversation ID
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: Invalid conversation ID
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Delete conversations
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"excludedIds\":[\"abc123\"]}'\n"
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security_ai_assistant/current_user/conversations
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters.'
operationId: CreateConversation
requestBody:
content:
application/json:
examples:
CreateConversationRequest:
value:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
excludeFromLastConversationStorage: false
messages:
- content: Hello, how can I assist you today?
role: system
timestamp: '2023-10-31T12:00:00Z'
replacements: {}
title: Security Discussion
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCreateProps'
required: true
responses:
'200':
content:
application/json:
examples:
CreateConversationResponse200Example:
value:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: Hello, how can I assist you today?
role: system
timestamp: '2023-10-31T12:00:00Z'
namespace: default
replacements: {}
title: Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
description: Indicates a successful call. The conversation was created successfully.
'400':
content:
application/json:
examples:
CreateConversationResponse400Example:
value:
error: Bad Request
message: 'Missing required parameter: title'
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: 'Missing required parameter: title'
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Create a conversation
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"title\":\"Security Discussion\",\"category\":\"assistant\",\"messages\":[{\"content\":\"Hello\",\"role\":\"system\",\"timestamp\":\"2023-10-31T12:00:00Z\"}],\"apiConfig\":{\"connectorId\":\"12345\",\"actionTypeId\":\"67890\"},\"replacements\":{},\"excludeFromLastConversationStorage\":false}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/current_user/conversations/_find:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/current_user/conversations/_find
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations.'
operationId: FindConversations
parameters:
- description: A list of fields to include in the response. If omitted, all fields are returned.
in: query
name: fields
required: false
schema:
example:
- id
- title
- createdAt
items:
type: string
type: array
- description: A search query to filter the conversations. Can match against titles, messages, or other conversation attributes.
in: query
name: filter
required: false
schema:
example: Security Issue
type: string
- description: The field by which to sort the results. Valid fields are `created_at`, `title`, and `updated_at`.
in: query
name: sort_field
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindConversationsSortField'
example: created_at
- description: The order in which to sort the results. Can be either `asc` for ascending or `desc` for descending.
in: query
name: sort_order
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
example: desc
- description: The page number of the results to retrieve. Default is 1.
in: query
name: page
required: false
schema:
default: 1
example: 1
minimum: 1
type: integer
- description: The number of conversations to return per page. Default is 20.
in: query
name: per_page
required: false
schema:
default: 20
example: 20
minimum: 0
type: integer
- description: Whether to return conversations that the current user owns. If true, only conversations owned by the user are returned.
in: query
name: is_owner
required: false
schema:
default: false
example: true
type: boolean
responses:
'200':
content:
application/json:
examples:
FindConversationsResponse200Example:
value:
data:
- category: assistant
createdAt: '2023-10-31T12:00:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: false
id: conv-abc123
messages: []
namespace: default
replacements: {}
title: Security Discussion
updatedAt: '2023-10-31T12:05:00Z'
users:
- id: user1
name: John Doe
page: 1
perPage: 20
total: 5
schema:
type: object
properties:
data:
description: A list of conversations.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
type: array
page:
description: The current page of the results.
example: 1
type: integer
perPage:
description: The number of results returned per page.
example: 20
type: integer
total:
description: The total number of conversations matching the filter criteria.
example: 100
type: integer
required:
- page
- perPage
- total
- data
description: Successful response, returns a paginated list of conversations matching the specified criteria.
'400':
content:
application/json:
examples:
FindConversationsResponse400Example:
value:
error: Bad Request
message: Invalid filter parameter.
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: Invalid filter query parameter
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Get conversations
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/current_user/conversations/{id}:
delete:
description: '**Spaces method and path for this operation:**
delete /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete an existing conversation using the conversation ID. This endpoint allows users to permanently delete a conversation.'
operationId: DeleteConversation
parameters:
- description: The conversation's `id` value.
example: abc123
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
responses:
'200':
content:
application/json:
examples:
DeleteConversationResponse200Example:
value:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: The conversation has been deleted.
role: system
timestamp: '2023-10-31T12:35:00Z'
namespace: default
replacements: {}
title: Deleted Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
description: Indicates a successful call. The conversation was deleted successfully.
'400':
content:
application/json:
examples:
DeleteConversationResponse400Example:
value:
error: Bad Request
message: Invalid conversation ID
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: Invalid conversation ID
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Delete a conversation
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the details of an existing conversation using the conversation ID. This allows users to fetch the specific conversation data by its unique ID.'
operationId: ReadConversation
parameters:
- description: The conversation's `id` value, a unique identifier for the conversation.
example: abc123
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
responses:
'200':
content:
application/json:
examples:
ReadConversationResponse200Example:
value:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: Hello, how can I assist you today?
role: system
timestamp: '2023-10-31T12:00:00Z'
namespace: default
replacements: {}
title: Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
description: Indicates a successful call. The conversation details are returned.
'400':
content:
application/json:
examples:
ReadConversationResponse400Example:
value:
error: Bad Request
message: Invalid conversation ID
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: Invalid conversation ID
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Get a conversation
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update an existing conversation using the conversation ID. This endpoint allows users to modify the details of an existing conversation.'
operationId: UpdateConversation
parameters:
- description: The conversation's `id` value.
example: abc123
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
requestBody:
content:
application/json:
examples:
UpdateConversationRequest:
value:
apiConfig:
actionTypeId: 09876
connectorId: '54321'
category: insights
excludeFromLastConversationStorage: true
messages:
- content: The issue was resolved.
role: assistant
timestamp: '2023-10-31T12:30:00Z'
replacements: {}
title: Updated Security Discussion
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationUpdateProps'
required: true
responses:
'200':
content:
application/json:
examples:
UpdateConversationResponse200Example:
value:
apiConfig:
actionTypeId: 09876
connectorId: '54321'
category: insights
createdAt: '2023-10-31T12:01:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: true
id: abc123
messages:
- content: The issue was resolved.
role: assistant
timestamp: '2023-10-31T12:30:00Z'
namespace: default
replacements: {}
title: Updated Security Discussion
updatedAt: '2023-10-31T12:31:00Z'
users:
- id: user1
name: John Doe
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
description: Indicates a successful call. The conversation was updated successfully.
'400':
content:
application/json:
examples:
UpdateConversationResponse400Example:
value:
error: Bad Request
message: 'Missing required field: title'
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: 'Missing required field: title'
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Update a conversation
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request PUT 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"title\":\"Updated Security Discussion\",\"category\":\"insights\",\"messages\":[{\"content\":\"Resolved.\",\"role\":\"assistant\",\"timestamp\":\"2023-10-31T12:30:00Z\"}],\"apiConfig\":{\"connectorId\":\"54321\",\"actionTypeId\":\"09876\"},\"replacements\":{},\"excludeFromLastConversationStorage\":true}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/knowledge_base:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/knowledge_base
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Read a single KB'
operationId: GetKnowledgeBase
responses:
'200':
content:
application/json:
examples:
KnowledgeBaseReadResponse200Example2:
summary: A response that returns information about the knowledge base.
value:
defend_insights_exists: true
elser_exists: false
is_setup_available: true
is_setup_in_progress: true
product_documentation_status: installed
security_labs_exists: false
user_data_exists: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseReadResponse200'
description: Indicates a successful call.
'400':
content:
application/json:
examples:
GetKnowledgeBaseResponse400Example:
value:
error: Bad Request
message: Invalid resource ID provided.
statusCode: 400
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
description: Bad Request response.
summary: Read a KnowledgeBase
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security_ai_assistant/knowledge_base
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a knowledge base. Use this endpoint when no specific resource identifier is needed.'
operationId: PostKnowledgeBase
parameters:
- description: ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.
example: elser-model-001
in: query
name: modelId
required: false
schema:
type: string
- description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
example: true
in: query
name: ignoreSecurityLabs
required: false
schema:
default: false
type: boolean
responses:
'200':
content:
application/json:
examples:
KnowledgeBaseResponse200Example2:
summary: A response that indicates that the request was successful.
value:
success: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
description: Indicates a successful call.
'400':
content:
application/json:
examples:
KnowledgeBaseResponse400Example2:
summary: A response for a request that failed due to an invalid query parameter value.
value: 'statusCode: 400 error: Bad Request message: "[request query]: ignoreSecurityLabs: Invalid enum value. Expected ''true'' | ''false'', received ''yes'', ignoreSecurityLabs: Expected boolean, received string"
'
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
description: Bad Request response.
summary: Create a KnowledgeBase
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base?ignoreSecurityLabs=false' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/knowledge_base/{resource}:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Read a knowledge base with a specific resource identifier.'
operationId: ReadKnowledgeBase
parameters:
- description: The KnowledgeBase `resource` value.
example: kb12345
in: path
name: resource
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
KnowledgeBaseReadResponse200Example1:
summary: A response that returns information about the knowledge base.
value:
defend_insights_exists: true
elser_exists: false
is_setup_available: true
is_setup_in_progress: true
product_documentation_status: installed
security_labs_exists: false
user_data_exists: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseReadResponse200'
description: Indicates a successful call.
'400':
content:
application/json:
examples:
ReadKnowledgeBaseResponse400Example:
value:
error: Bad Request
message: Invalid resource ID provided.
statusCode: 400
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
description: Bad Request response.
summary: Read a KnowledgeBase for a resource
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/kb12345' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a knowledge base with a specific resource identifier.'
operationId: CreateKnowledgeBase
parameters:
- description: The KnowledgeBase `resource` value.
example: kb12345
in: path
name: resource
required: true
schema:
type: string
- description: ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.
example: elser-model-001
in: query
name: modelId
required: false
schema:
type: string
- description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
example: true
in: query
name: ignoreSecurityLabs
required: false
schema:
default: false
type: boolean
responses:
'200':
content:
application/json:
examples:
KnowledgeBaseResponse200Example1:
summary: A response that indicates that the request was successful.
value:
success: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
description: Indicates a successful call.
'400':
content:
application/json:
examples:
KnowledgeBaseResponse400Example1:
summary: A response for a request that failed due to an invalid query parameter value.
value: 'statusCode: 400 error: Bad Request message: "[request query]: ignoreSecurityLabs: Invalid enum value. Expected ''true'' | ''false'', received ''yes'', ignoreSecurityLabs: Expected boolean, received string"
'
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
description: Bad Request response.
summary: Create a KnowledgeBase for a resource
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/kb12345?ignoreSecurityLabs=false' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/knowledge_base/entries:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security_ai_assistant/knowledge_base/entries
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a Knowledge Base Entry'
operationId: CreateKnowledgeBaseEntry
requestBody:
content:
application/json:
examples:
CreateKnowledgeBaseEntryRequest:
value:
kbResource: user
name: How to reset a password
source: manual
text: To reset your password, go to the settings page and click 'Reset Password'.
type: document
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
required: true
responses:
'200':
content:
application/json:
examples:
CreateKnowledgeBaseEntryResponse200Example:
value:
createdAt: '2024-01-15T10:00:00.000Z'
createdBy: user@example.com
global: false
id: '12345'
kbResource: user
name: How to reset a password
namespace: default
source: manual
text: To reset your password, go to the settings page and click 'Reset Password'.
type: document
updatedAt: '2024-01-15T10:00:00.000Z'
updatedBy: user@example.com
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
description: Successful request returning Knowledge Base Entries
'400':
content:
application/json:
examples:
CreateKnowledgeBaseEntryResponse400Example:
value:
error: Invalid input
message: The 'name' field is required.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
description: Bad Request response.
summary: Create a Knowledge Base Entry
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"name\":\"How to reset a password\",\"type\":\"document\",\"kbResource\":\"user\",\"source\":\"manual\",\"text\":\"To reset your password, go to the settings page and click Reset Password.\"}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/knowledge_base/entries/_bulk_action:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_bulk_action
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.'
operationId: PerformKnowledgeBaseEntryBulkAction
requestBody:
content:
application/json:
examples:
PerformKnowledgeBaseEntryBulkActionRequest:
value:
create:
- kbResource: user
name: New Entry
source: manual
text: This is the content of the new entry.
type: document
delete:
ids:
- '789'
update:
- id: '123'
kbResource: user
name: Updated Entry
source: manual
text: Updated content.
type: document
schema:
type: object
properties:
create:
description: List of Knowledge Base Entries to create.
example:
- kbResource: user
name: New Entry
source: manual
text: This is the content of the new entry.
type: document
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
type: array
delete:
type: object
properties:
ids:
description: Array of Knowledge Base Entry IDs.
example:
- '123'
- '456'
- '789'
items:
type: string
minItems: 1
type: array
query:
description: Query to filter Knowledge Base Entries.
example: status:active AND category:technology
type: string
update:
description: List of Knowledge Base Entries to update.
example:
- id: '123'
kbResource: user
name: Updated Entry
source: manual
text: Updated content.
type: document
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
type: array
responses:
'200':
content:
application/json:
examples:
PerformKnowledgeBaseEntryBulkActionResponse200Example:
value:
attributes:
results:
created:
- createdAt: '2024-01-15T10:00:00.000Z'
createdBy: user@example.com
global: false
id: '456'
kbResource: user
name: New Entry
namespace: default
source: manual
text: This is the content of the new entry.
type: document
updatedAt: '2024-01-15T10:00:00.000Z'
updatedBy: user@example.com
deleted:
- '789'
skipped: []
updated:
- createdAt: '2024-01-14T09:00:00.000Z'
createdBy: user@example.com
global: false
id: '123'
kbResource: user
name: Updated Entry
namespace: default
source: manual
text: Updated content.
type: document
updatedAt: '2024-01-15T10:00:00.000Z'
updatedBy: user@example.com
summary:
failed: 0
skipped: 0
succeeded: 3
total: 3
knowledgeBaseEntriesCount: 3
message: Bulk action completed successfully.
statusCode: 200
success: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse'
description: Successful bulk operation request
'400':
content:
application/json:
examples:
PerformKnowledgeBaseEntryBulkActionResponse400Example:
value:
error: Bad Request
message: Invalid request body.
statusCode: 400
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
description: Bad Request response.
summary: Applies a bulk action to multiple Knowledge Base Entries
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"create\":[{\"name\":\"Runbook\",\"type\":\"document\",\"kbResource\":\"user\",\"source\":\"manual\",\"text\":\"Steps to triage an alert.\"}]}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/knowledge_base/entries/_find:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_find
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Finds Knowledge Base Entries that match the given query.'
operationId: FindKnowledgeBaseEntries
parameters:
- description: A list of fields to include in the response. If not provided, all fields will be included.
in: query
name: fields
required: false
schema:
example:
- name
- created_at
items:
type: string
type: array
- description: Search query to filter Knowledge Base Entries by specific criteria.
in: query
name: filter
required: false
schema:
example: error handling
type: string
- description: Field to sort the Knowledge Base Entries by.
in: query
name: sort_field
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField'
example: created_at
- description: Sort order for the results, either asc or desc.
in: query
name: sort_order
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
example: asc
- description: Page number for paginated results. Defaults to 1.
in: query
name: page
required: false
schema:
default: 1
example: 2
minimum: 1
type: integer
- description: Number of Knowledge Base Entries to return per page. Defaults to 20.
in: query
name: per_page
required: false
schema:
default: 20
example: 10
minimum: 0
type: integer
responses:
'200':
content:
application/json:
examples:
FindKnowledgeBaseEntriesResponse200Example:
value:
data:
- createdAt: '2024-01-15T10:00:00.000Z'
createdBy: user@example.com
global: false
id: '12345'
kbResource: user
name: How to reset a password
namespace: default
source: manual
text: To reset your password, go to the settings page and click 'Reset Password'.
type: document
updatedAt: '2024-01-15T10:00:00.000Z'
updatedBy: user@example.com
page: 1
perPage: 20
total: 100
schema:
type: object
properties:
data:
description: The list of Knowledge Base Entries for the current page.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
type: array
page:
description: The current page number.
example: 1
type: integer
perPage:
description: The number of Knowledge Base Entries returned per page.
example: 20
type: integer
total:
description: The total number of Knowledge Base Entries available.
example: 100
type: integer
required:
- page
- perPage
- total
- data
description: Successful response containing the paginated Knowledge Base Entries.
'400':
content:
application/json:
examples:
FindKnowledgeBaseEntriesResponse400Example:
value:
error: Bad Request
message: 'Invalid query parameter: sort_order'
statusCode: 400
schema:
type: object
properties:
error:
description: A short description of the error.
example: Bad Request
type: string
message:
description: A detailed message explaining the error.
example: 'Invalid query parameter: sort_order'
type: string
statusCode:
description: The HTTP status code of the error.
example: 400
type: number
description: Bad Request response.
summary: Finds Knowledge Base Entries that match the given query.
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/knowledge_base/entries/{id}:
delete:
description: '**Spaces method and path for this operation:**
delete /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete a Knowledge Base Entry by its unique `id`.'
operationId: DeleteKnowledgeBaseEntry
parameters:
- description: The unique identifier (`id`) of the Knowledge Base Entry to delete.
example: '12345'
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
responses:
'200':
content:
application/json:
examples:
DeleteKnowledgeBaseEntryResponse200Example:
value:
id: '12345'
message: Knowledge Base Entry successfully deleted.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields'
description: Successful request returning the `id` of the deleted Knowledge Base Entry.
'400':
content:
application/json:
examples:
DeleteKnowledgeBaseEntryResponse400Example:
value:
error: Not Found
message: No Knowledge Base Entry found with the provided `id`.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
description: Bad Request response.
summary: Deletes a single Knowledge Base Entry using the `id` field
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Retrieve a Knowledge Base Entry by its unique `id`.'
operationId: ReadKnowledgeBaseEntry
parameters:
- description: The unique identifier (`id`) of the Knowledge Base Entry to retrieve.
example: '12345'
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
responses:
'200':
content:
application/json:
examples:
ReadKnowledgeBaseEntryResponse200Example:
value:
createdAt: '2024-01-15T10:00:00.000Z'
createdBy: user@example.com
global: false
id: '12345'
kbResource: user
name: How to reset a password
namespace: default
source: manual
text: To reset your password, go to the settings page and click 'Reset Password'.
type: document
updatedAt: '2024-01-15T10:00:00.000Z'
updatedBy: user@example.com
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
description: Successful request returning the requested Knowledge Base Entry.
'400':
content:
application/json:
examples:
ReadKnowledgeBaseEntryResponse400Example:
value:
error: Not Found
message: No Knowledge Base Entry found with the provided `id`.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
description: Bad Request response.
summary: Read a Knowledge Base Entry
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update an existing Knowledge Base Entry by its unique `id`.'
operationId: UpdateKnowledgeBaseEntry
parameters:
- description: The unique identifier (`id`) of the Knowledge Base Entry to update.
example: '12345'
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
requestBody:
content:
application/json:
examples:
UpdateKnowledgeBaseEntryRequest:
value:
kbResource: user
name: How to reset a password (updated)
source: manual
text: 'Updated: go to settings and click Reset Password, then follow the on-screen instructions.'
type: document
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps'
required: true
responses:
'200':
content:
application/json:
examples:
UpdateKnowledgeBaseEntryResponse200Example:
value:
createdAt: '2024-01-15T10:00:00.000Z'
createdBy: user@example.com
global: false
id: '12345'
kbResource: user
name: How to reset a password (updated)
namespace: default
source: manual
text: 'Updated: go to settings and click Reset Password, then follow the on-screen instructions.'
type: document
updatedAt: '2024-01-15T10:05:00.000Z'
updatedBy: user@example.com
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
description: Successful request returning the updated Knowledge Base Entry.
'400':
content:
application/json:
examples:
UpdateKnowledgeBaseEntryResponse400Example:
value:
error: Invalid input
message: The 'text' field cannot be empty.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
description: Bad Request response.
summary: Update a Knowledge Base Entry
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request PUT 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"name\":\"How to reset a password (updated)\",\"type\":\"document\",\"kbResource\":\"user\",\"source\":\"manual\",\"text\":\"Updated: go to settings and click Reset Password, then follow the on-screen instructions.\"}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/prompts/_bulk_action:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security_ai_assistant/prompts/_bulk_action
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Apply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs. This action allows for bulk create, update, or delete operations.'
operationId: PerformPromptsBulkAction
requestBody:
content:
application/json:
examples:
PerformPromptsBulkActionRequest:
value:
create:
- content: Please verify the security settings.
name: New Security Prompt
promptType: system
delete:
ids:
- prompt1
- prompt2
update:
- content: Updated content for security prompt.
id: prompt123
schema:
type: object
properties:
create:
description: List of prompts to be created.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptCreateProps'
type: array
delete:
description: Criteria for deleting prompts in bulk.
type: object
properties:
ids:
description: Array of IDs to apply the action to.
example:
- '1234'
- '5678'
items:
type: string
minItems: 1
type: array
query:
description: Query to filter the bulk action.
example: 'status: ''inactive'''
type: string
update:
description: List of prompts to be updated.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptUpdateProps'
type: array
responses:
'200':
content:
application/json:
examples:
success:
value:
attributes:
errors: []
results:
created:
- content: Please verify the security settings.
id: prompt6
name: New Security Prompt
promptType: system
deleted:
- prompt2
- prompt3
skipped:
- id: prompt4
name: Security Prompt
skip_reason: PROMPT_FIELD_NOT_MODIFIED
updated:
- content: Updated security settings prompt
id: prompt1
name: Security Prompt
promptType: system
summary:
failed: 0
skipped: 1
succeeded: 4
total: 5
message: Bulk action completed successfully.
prompts_count: 5
status_code: 200
success: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResponse'
description: Indicates a successful call with the results of the bulk action.
'400':
content:
application/json:
examples:
PerformPromptsBulkActionResponse400Example:
value:
error: Bad Request
message: Invalid prompt ID or missing required fields.
statusCode: 400
schema:
type: object
properties:
error:
description: A short error message.
example: Bad Request
type: string
message:
description: A detailed error message.
example: Invalid prompt ID or missing required fields.
type: string
statusCode:
description: The HTTP status code for the error.
example: 400
type: number
description: Bad Request response.
summary: Apply a bulk action to prompts
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/prompts/_bulk_action' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"delete\":{\"query\":\"name: test\",\"ids\":[]}}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/prompts/_find:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security_ai_assistant/prompts/_find
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of all prompts based on optional filters, sorting, and pagination.'
operationId: FindPrompts
parameters:
- description: List of specific fields to include in each returned prompt.
in: query
name: fields
required: false
schema:
example:
- id
- name
- content
items:
type: string
type: array
- description: Search query string to filter prompts by matching fields.
in: query
name: filter
required: false
schema:
example: error handling
type: string
- description: Field to sort prompts by.
in: query
name: sort_field
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindPromptsSortField'
- description: Sort order, either asc or desc.
in: query
name: sort_order
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
- description: Page number for pagination.
in: query
name: page
required: false
schema:
default: 1
example: 1
minimum: 1
type: integer
- description: Number of prompts per page.
in: query
name: per_page
required: false
schema:
default: 20
example: 20
minimum: 0
type: integer
responses:
'200':
content:
application/json:
examples:
FindPromptsResponse200Example:
value:
data:
- categories:
- troubleshooting
- logging
color: '#FF5733'
consumer: security
content: If you encounter an error, check the logs and retry.
createdAt: '2025-04-20T21:00:00Z'
createdBy: jdoe
id: prompt-123
isDefault: true
isNewConversationDefault: false
name: Error Troubleshooting Prompt
namespace: default
promptType: standard
timestamp: '2025-04-30T22:30:00Z'
updatedAt: '2025-04-30T22:45:00Z'
updatedBy: jdoe
users:
- full_name: John Doe
username: jdoe
page: 1
perPage: 20
total: 142
schema:
example:
data:
- categories:
- troubleshooting
- logging
color: '#FF5733'
consumer: security
content: If you encounter an error, check the logs and retry.
createdAt: '2025-04-20T21:00:00Z'
createdBy: jdoe
id: prompt-123
isDefault: true
isNewConversationDefault: false
name: Error Troubleshooting Prompt
namespace: default
promptType: standard
timestamp: '2025-04-30T22:30:00Z'
updatedAt: '2025-04-30T22:45:00Z'
updatedBy: jdoe
users:
- full_name: John Doe
username: jdoe
page: 1
perPage: 20
total: 142
type: object
properties:
data:
description: The list of prompts returned based on the search query, sorting, and pagination.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
type: array
page:
description: Current page number.
example: 1
type: integer
perPage:
description: Number of prompts per page.
example: 20
type: integer
total:
description: Total number of prompts matching the query.
example: 142
type: integer
required:
- page
- perPage
- total
- data
description: Successful response containing a list of prompts.
'400':
content:
application/json:
examples:
FindPromptsResponse400Example:
value:
error: Bad Request
message: Invalid sort order value provided.
statusCode: 400
schema:
type: object
properties:
error:
description: Short error message.
example: Bad Request
type: string
message:
description: Detailed description of the error.
example: Invalid sort order value provided.
type: string
statusCode:
description: HTTP status code for the error.
example: 400
type: number
description: Bad request due to invalid parameters or malformed query.
summary: Get prompts
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/prompts/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
components:
schemas:
Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults:
type: object
properties:
created:
description: List of anonymization fields successfully created.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
type: array
deleted:
items:
description: Array of IDs of anonymization fields that were deleted.
example: field3
type: string
type: array
skipped:
description: List of anonymization fields that were skipped during the operation.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult'
type: array
updated:
description: List of anonymization fields successfully updated.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
type: array
required:
- updated
- created
- deleted
- skipped
Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult:
type: object
properties:
id:
description: ID of the skipped Knowledge Base Entry.
example: '123'
type: string
name:
description: Name of the skipped Knowledge Base Entry.
example: Skipped Entry
type: string
skip_reason:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason'
required:
- id
- skip_reason
Security_AI_Assistant_API_Replacements:
additionalProperties:
type: string
description: Replacements object used to anonymize/deanonymize messages
type: object
Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
discriminator:
mapping:
document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
index: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
propertyName: type
Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary:
type: object
properties:
failed:
description: Number of Knowledge Base Entries that failed during the bulk action.
example: 2
type: integer
skipped:
description: Number of Knowledge Base Entries that were skipped during the bulk action.
example: 1
type: integer
succeeded:
description: Number of Knowledge Base Entries that were successfully processed during the bulk action.
example: 5
type: integer
total:
description: Total number of Knowledge Base Entries involved in the bulk action.
example: 8
type: integer
required:
- failed
- skipped
- succeeded
- total
Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse:
type: object
properties:
attributes:
type: object
properties:
errors:
description: List of errors encountered during the bulk action.
example:
- err_code: UPDATE_FAILED
knowledgeBaseEntries:
- id: '456'
name: Error Entry
message: Failed to update entry.
statusCode: 400
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError'
type: array
results:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary'
required:
- results
- summary
knowledgeBaseEntriesCount:
description: Total number of Knowledge Base Entries processed.
example: 8
type: integer
message:
description: Message describing the result of the bulk action.
example: Bulk action completed successfully.
type: string
statusCode:
description: HTTP status code of the response.
example: 200
type: integer
success:
description: Indicates whether the bulk action was successful.
example: true
type: boolean
required:
- attributes
Security_AI_Assistant_API_KnowledgeBaseReadResponse200:
type: object
properties:
defend_insights_exists:
description: Indicates if Defend Insights documentation exists in the KnowledgeBase.
example: true
type: boolean
elser_exists:
description: Indicates if the ELSER model exists for the KnowledgeBase.
example: true
type: boolean
is_setup_available:
description: Indicates if the setup process is available for the KnowledgeBase.
example: true
type: boolean
is_setup_in_progress:
description: Indicates if the setup process is currently in progress.
example: false
type: boolean
product_documentation_status:
description: The status of the product documentation in the KnowledgeBase.
example: complete
type: string
security_labs_exists:
description: Indicates if Security Labs documentation exists in the KnowledgeBase.
example: true
type: boolean
user_data_exists:
description: Indicates if user data exists in the KnowledgeBase.
example: false
type: boolean
Security_AI_Assistant_API_MessageRole:
description: Message role.
enum:
- system
- user
- assistant
example: assistant
type: string
Security_AI_Assistant_API_KnowledgeBaseEntryResponse:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
discriminator:
mapping:
document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
index: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
propertyName: type
Security_AI_Assistant_API_BaseInterruptResumeValue:
description: The basis of an interrupt resume value
type: object
properties:
type:
$ref: '#/components/schemas/Security_AI_Assistant_API_InterruptType'
description: Type of the resume value
example: SELECT_OPTION
required:
- type
Security_AI_Assistant_API_AnonymizationFieldResponse:
type: object
properties:
allowed:
description: Whether this field is allowed to be sent to the model.
example: true
type: boolean
anonymized:
description: Whether this field should be anonymized.
example: false
type: boolean
createdAt:
description: Timestamp of when the anonymization field was created.
example: '2023-10-31T12:00:00Z'
type: string
createdBy:
description: Username of the person who created the anonymization field.
example: user1
type: string
field:
description: Name of the anonymization field.
example: url.domain
type: string
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
description: The ID of the anonymization field.
namespace:
description: Kibana space in which this anonymization field exists.
example: default
type: string
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
description: Timestamp when the anonymization field was initially created.
updatedAt:
description: Timestamp of the last update.
example: '2023-10-31T12:00:00Z'
type: string
updatedBy:
description: Username of the person who last updated the field.
example: user1
type: string
required:
- id
- field
Security_AI_Assistant_API_ConversationCategory:
description: The conversation category.
enum:
- assistant
- insights
example: assistant
type: string
Security_AI_Assistant_API_TraceData:
description: Trace Data
type: object
properties:
traceId:
description: Could be any string, not necessarily a UUID
example: d9876543-f0a1-2345-6789-abcdef123456
type: string
transactionId:
description: Could be any string, not necessarily a UUID
example: a1234567-bc89-0def-1234-56789abcdef0
type: string
Security_AI_Assistant_API_ContentReferences:
additionalProperties:
oneOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_SecurityAlertContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_SecurityAlertsPageContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_ProductDocumentationContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_EsqlContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_HrefContentReference'
additionalProperties: false
description: A union of all content reference types
type: object
Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
discriminator:
mapping:
document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
index: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
propertyName: type
Security_AI_Assistant_API_InputTextInterruptValue:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptValue'
- type: object
properties:
description:
description: Description of action required
example: What is the index you would like to use for the query.
type: string
placeholder:
description: Placeholder text for the input field
example: Enter index pattern here...
type: string
type:
enum:
- INPUT_TEXT
example: INPUT_TEXT
type: string
required:
- type
description: Interrupt that requests user to provide text input
Security_AI_Assistant_API_ResponseFields:
type: object
properties:
createdAt:
description: Time the Knowledge Base Entry was created.
example: '2023-01-01T12:00:00Z'
type: string
createdBy:
description: User who created the Knowledge Base Entry.
example: admin
type: string
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
updatedAt:
description: Time the Knowledge Base Entry was last updated.
example: '2023-01-02T12:00:00Z'
type: string
updatedBy:
description: User who last updated the Knowledge Base Entry.
example: editor
type: string
required:
- id
- createdAt
- createdBy
- updatedAt
- updatedBy
Security_AI_Assistant_API_Reader:
additionalProperties: true
type: object
Security_AI_Assistant_API_ChatMessageRole:
description: The role associated with the message in the chat.
enum:
- system
- user
- assistant
example: user
type: string
Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason:
description: Reason why a Knowledge Base Entry was skipped during the bulk action.
enum:
- KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
type: string
Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason:
description: Reason why the anonymization field was not modified.
enum:
- ANONYMIZATION_FIELD_NOT_MODIFIED
type: string
Security_AI_Assistant_API_InputTextInterruptResumeValue:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptResumeValue'
- type: object
properties:
type:
enum:
- INPUT_TEXT
example: INPUT_TEXT
type: string
value:
description: Text value used to resume the graph execution with.
example: .logs*
type: string
required:
- value
- type
description: A resume value for input text
Security_AI_Assistant_API_FindAnonymizationFieldsSortField:
enum:
- created_at
- anonymized
- allowed
- field
- updated_at
type: string
Security_AI_Assistant_API_SortOrder:
description: The order in which results are sorted.
enum:
- asc
- desc
example: asc
type: string
Security_AI_Assistant_API_PromptDetailsInError:
type: object
properties:
id:
description: The ID of the prompt that encountered an error.
type: string
name:
description: The name of the prompt that encountered an error.
type: string
required:
- id
Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse:
type: object
properties:
anonymization_fields_count:
description: Total number of anonymization fields processed.
example: 5
type: integer
attributes:
type: object
properties:
errors:
description: List of errors that occurred during the bulk operation.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedAnonymizationFieldError'
type: array
results:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary'
required:
- results
- summary
message:
description: Message providing information about the bulk action result.
example: Bulk action completed successfully
type: string
status_code:
description: HTTP status code returned.
example: 200
type: integer
success:
description: Indicates if the bulk action was successful.
example: true
type: boolean
required:
- attributes
Security_AI_Assistant_API_DocumentEntry:
allOf:
- type: object
properties:
global:
description: Whether this Knowledge Base Entry is global, defaults to false.
example: false
type: boolean
name:
description: Name of the Knowledge Base Entry.
example: Example Entry
type: string
namespace:
description: Kibana Space, defaults to 'default' space.
example: default
type: string
users:
description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- name
- namespace
- global
- users
- $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields'
Security_AI_Assistant_API_SecurityAlertsPageContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- type: object
properties:
type:
enum:
- SecurityAlertsPage
example: SecurityAlertsPage
type: string
required:
- type
description: References the security alerts page
Security_AI_Assistant_API_NonEmptyString:
description: A string that does not contain only whitespace characters.
example: I am a string
format: nonempty
minLength: 1
type: string
Security_AI_Assistant_API_FindConversationsSortField:
description: The field by which to sort the conversations. Possible values are `created_at`, `title`, and `updated_at`.
enum:
- created_at
- title
- updated_at
example: created_at
type: string
Security_AI_Assistant_API_PromptUpdateProps:
type: object
properties:
categories:
description: The updated categories for the prompt.
example:
- security
- alert
items:
type: string
type: array
color:
description: The updated color associated with the prompt.
example: green
type: string
consumer:
description: The updated consumer for the prompt.
example: user123
type: string
content:
description: The updated content for the prompt.
example: Updated content for security prompt.
type: string
id:
description: The ID of the prompt to update.
example: prompt123
type: string
isDefault:
description: Whether this prompt should be the default.
example: true
type: boolean
isNewConversationDefault:
description: Whether the prompt should be the default for new conversations.
example: false
type: boolean
required:
- id
Security_AI_Assistant_API_PromptResponse:
type: object
properties:
categories:
description: Categories associated with the prompt.
items:
type: string
type: array
color:
description: The color associated with the prompt.
type: string
consumer:
description: The consumer that the prompt is associated with.
type: string
content:
description: The content of the prompt.
type: string
createdAt:
description: The timestamp of when the prompt was created.
type: string
createdBy:
description: The user who created the prompt.
type: string
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
isDefault:
description: Whether this prompt is the default.
type: boolean
isNewConversationDefault:
description: Whether this prompt is the default for new conversations.
type: boolean
name:
description: The name of the prompt.
type: string
namespace:
description: Kibana space where the prompt is located.
type: string
promptType:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptType'
description: The type of the prompt.
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
updatedAt:
description: The timestamp of when the prompt was last updated.
type: string
updatedBy:
description: The user who last updated the prompt.
type: string
users:
description: List of users associated with the prompt.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- id
- name
- promptType
- content
Security_AI_Assistant_API_ConversationResponse:
type: object
properties:
apiConfig:
$ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
description: LLM API configuration.
category:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
description: The conversation category.
example: assistant
createdAt:
description: The time conversation was created.
example: '2025-04-30T14:00:00Z'
type: string
createdBy:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: The user who created the conversation.
excludeFromLastConversationStorage:
description: Exclude from last conversation storage.
type: boolean
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
messages:
description: The conversation messages.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_Message'
type: array
namespace:
description: Kibana space
example: default
type: string
replacements:
$ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
title:
description: The conversation title.
example: Security AI Assistant Setup
type: string
updatedAt:
description: The last time conversation was updated.
example: '2025-04-30T16:30:00Z'
type: string
users:
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- id
- title
- createdAt
- createdBy
- users
- namespace
- category
Security_AI_Assistant_API_InterruptValue:
description: Union of the interrupt values
oneOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptValue'
additionalProperties: false
- $ref: '#/components/schemas/Security_AI_Assistant_API_InputTextInterruptValue'
additionalProperties: false
Security_AI_Assistant_API_SelectOptionInterruptValue:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptValue'
- type: object
properties:
description:
description: Description of action required
example: Select one of the options
type: string
options:
description: List of actions to choose from
example:
- label: Option 1
- label: Option 2
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptOption'
type: array
type:
enum:
- SELECT_OPTION
example: SELECT_OPTION
type: string
required:
- type
- description
- options
description: Interrupt that requests user to select one of the provided options
Security_AI_Assistant_API_BaseContentReference:
description: The basis of a content reference
type: object
properties:
id:
description: Id of the content reference
example: content123
type: string
type:
description: Type of the content reference
example: SecurityAlert
type: string
required:
- id
- type
Security_AI_Assistant_API_ProductDocumentationContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- type: object
properties:
title:
description: Title of the documentation
example: Getting Started with Security AI Assistant
type: string
type:
enum:
- ProductDocumentation
example: ProductDocumentation
type: string
url:
description: URL to the documentation
example: https://docs.example.com/security-ai-assistant
type: string
required:
- type
- title
- url
description: References the product documentation
Security_AI_Assistant_API_SelectOptionInterruptOption:
description: A request approval option
type: object
properties:
buttonColor:
enum:
- text
- accent
- accentSecondary
- primary
- success
- warning
- danger
- neutral
- risk
example: danger
type: string
label:
example: Option 1
type: string
value:
example: option_1
type: string
required:
- label
- value
Security_AI_Assistant_API_IndexEntryUpdateFields:
allOf:
- type: object
properties:
global:
description: Whether this Knowledge Base Entry is global, defaults to false.
example: false
type: boolean
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
name:
description: Name of the Knowledge Base Entry.
example: Example Entry
type: string
namespace:
description: Kibana Space, defaults to 'default' space.
example: default
type: string
users:
description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- id
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
Security_AI_Assistant_API_MessageData:
additionalProperties: true
description: ECS-style metadata attached to the message.
example:
alert_id: alert-456
user_id: abc123
type: object
Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
discriminator:
mapping:
document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
index: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
propertyName: type
Security_AI_Assistant_API_User:
description: Could be any string, not necessarily a UUID.
type: object
properties:
id:
description: User id.
example: user123
type: string
name:
description: User name.
example: John Doe
type: string
Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema:
additionalProperties: false
type: object
properties:
error:
description: Error type or category.
example: Not Found
type: string
message:
description: Detailed error message.
example: The requested Knowledge Base Entry was not found.
type: string
statusCode:
description: HTTP status code of the error.
example: 404
type: number
required:
- statusCode
- error
- message
Security_AI_Assistant_API_BaseInterruptValue:
description: The basis of an agent interrupt
type: object
properties:
expired:
description: Whether the interrupt has expired and can no longer be resumed.
example: false
type: boolean
threadId:
description: Thread ID of the graph execution that produced this message.
example:
type: string
type:
$ref: '#/components/schemas/Security_AI_Assistant_API_InterruptType'
description: Type of the interrupt
example: SELECT_OPTION
required:
- type
- threadId
Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError:
type: object
properties:
id:
description: ID of the Knowledge Base Entry that encountered an error.
example: '456'
type: string
name:
description: Name of the Knowledge Base Entry that encountered an error.
example: Error Entry
type: string
required:
- id
Security_AI_Assistant_API_DocumentEntryRequiredFields:
type: object
properties:
kbResource:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResource'
source:
description: Source document name or filepath.
example: /documents/example.txt
type: string
text:
description: Knowledge Base Entry content.
example: This is the content of the document.
type: string
type:
description: Entry type.
enum:
- document
example: document
type: string
required:
- type
- kbResource
- source
- text
Security_AI_Assistant_API_InterruptType:
description: The type of interrupt
enum:
- SELECT_OPTION
- INPUT_TEXT
type: string
Security_AI_Assistant_API_PromptCreateProps:
type: object
properties:
categories:
description: List of categories for the prompt.
example:
- security
- verification
items:
type: string
type: array
color:
description: The color associated with the prompt.
example: blue
type: string
consumer:
description: The consumer associated with the prompt.
example: admin
type: string
content:
description: The content of the prompt.
example: Please verify the security settings.
type: string
isDefault:
description: Whether this prompt should be the default.
example: false
type: boolean
isNewConversationDefault:
description: Whether this prompt should be the default for new conversations.
example: true
type: boolean
name:
description: The name of the prompt.
example: New Security Prompt
type: string
promptType:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptType'
description: The type of the prompt.
example: system
required:
- name
- content
- promptType
Security_AI_Assistant_API_EsqlContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- type: object
properties:
label:
description: Label of the query
example: High Severity Alerts
type: string
query:
description: An ESQL query
example: SELECT * FROM alerts WHERE severity = "high"
type: string
timerange:
description: Time range to select in the time picker.
type: object
properties:
from:
example: '2025-04-01T00:00:00Z'
type: string
to:
example: '2025-04-30T23:59:59Z'
type: string
required:
- from
- to
type:
enum:
- EsqlQuery
example: EsqlQuery
type: string
required:
- type
- query
- label
description: References an ESQL query
Security_AI_Assistant_API_InterruptResumeValue:
description: Union of the interrupt resume values
oneOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptResumeValue'
additionalProperties: false
- $ref: '#/components/schemas/Security_AI_Assistant_API_InputTextInterruptResumeValue'
additionalProperties: false
Security_AI_Assistant_API_PromptType:
description: Type of the prompt (either system or quick).
enum:
- system
- quick
type: string
Security_AI_Assistant_API_KnowledgeBaseResponse400:
type: object
properties:
error:
description: A short description of the error.
example: Bad Request
type: string
message:
description: A detailed error message.
example: Invalid resource ID provided.
type: string
statusCode:
description: The HTTP status code of the error.
example: 400
type: number
Security_AI_Assistant_API_DocumentEntryUpdateFields:
allOf:
- type: object
properties:
global:
description: Whether this Knowledge Base Entry is global, defaults to false.
example: false
type: boolean
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
name:
description: Name of the Knowledge Base Entry.
example: Example Entry
type: string
namespace:
description: Kibana Space, defaults to 'default' space.
example: default
type: string
users:
description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- id
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
Security_AI_Assistant_API_IndexEntryOptionalFields:
type: object
properties:
inputSchema:
$ref: '#/components/schemas/Security_AI_Assistant_API_InputSchema'
outputFields:
description: Fields to extract from the query result, defaults to all fields if not provided or empty.
example:
- title
- author
items:
type: string
type: array
Security_AI_Assistant_API_KnowledgeBaseResource:
description: Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
enum:
- security_labs
- defend_insights
- user
example: security_labs
type: string
Security_AI_Assistant_API_ConversationCreateProps:
type: object
properties:
apiConfig:
$ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
description: LLM API configuration.
category:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
description: The conversation category.
example: assistant
excludeFromLastConversationStorage:
description: Exclude from last conversation storage.
type: boolean
id:
description: The conversation id.
example: conversation123
type: string
messages:
description: The conversation messages.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_Message'
type: array
replacements:
$ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
title:
description: The conversation title.
example: Security AI Assistant Setup
type: string
required:
- title
Security_AI_Assistant_API_KnowledgeBaseEntryContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- type: object
properties:
knowledgeBaseEntryId:
description: Id of the Knowledge Base Entry
example: kbentry456
type: string
knowledgeBaseEntryName:
description: Name of the knowledge base entry
example: Network Security Best Practices
type: string
type:
enum:
- KnowledgeBaseEntry
example: KnowledgeBaseEntry
type: string
required:
- type
- knowledgeBaseEntryId
- knowledgeBaseEntryName
description: References a knowledge base entry
Security_AI_Assistant_API_PromptsBulkActionSkipResult:
type: object
properties:
id:
description: The ID of the prompt that was skipped.
type: string
name:
description: The name of the prompt that was skipped.
type: string
skip_reason:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipReason'
description: The reason for skipping the prompt.
required:
- id
- skip_reason
Security_AI_Assistant_API_ChatCompleteProps:
description: The request payload for creating a chat completion.
example:
connectorId: conn-001
conversationId: abc123
isStream: true
langSmithApiKey:
langSmithProject: security_ai_project
messages:
- content: How do I detect ransomware on my endpoints?
data:
device_id: device-567
fields_to_anonymize:
- device.name
- file.path
role: user
model: gpt-4
persist: true
promptId: prompt_456
responseLanguage: en
type: object
properties:
connectorId:
description: Required connector identifier to route the request.
example: conn-001
type: string
conversationId:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
description: Existing conversation ID to continue.
isStream:
description: If true, the response will be streamed in chunks.
example: true
type: boolean
langSmithApiKey:
description: API key for LangSmith integration.
example:
type: string
langSmithProject:
description: LangSmith project name for tracing.
example: security_ai_project
type: string
messages:
description: List of chat messages exchanged so far.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatMessage'
type: array
model:
description: Model ID or name to use for the response.
example: gpt-4
type: string
persist:
description: Whether to persist the chat and response to storage.
example: true
type: boolean
promptId:
description: Prompt template identifier.
example: prompt_001
type: string
responseLanguage:
description: ISO language code for the assistant's response.
example: en
type: string
required:
- messages
- persist
- connectorId
Security_AI_Assistant_API_ConversationUpdateProps:
type: object
properties:
apiConfig:
$ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
description: LLM API configuration.
category:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
description: The conversation category.
example: assistant
excludeFromLastConversationStorage:
description: Exclude from last conversation storage.
type: boolean
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
messages:
description: The conversation messages.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_Message'
type: array
replacements:
$ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
title:
description: The conversation title.
example: Updated Security AI Assistant Setup
type: string
users:
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- id
Security_AI_Assistant_API_HrefContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- type: object
properties:
href:
description: URL to the external resource
type: string
label:
description: Label of the query
type: string
type:
enum:
- Href
type: string
required:
- type
- href
description: References an external URL
Security_AI_Assistant_API_ChatMessage:
description: A message exchanged within the AI chat conversation.
type: object
properties:
content:
description: The textual content of the message.
example: What security incidents have been reported today?
type: string
data:
$ref: '#/components/schemas/Security_AI_Assistant_API_MessageData'
description: Metadata to attach to the context of the message.
fields_to_anonymize:
description: List of field names within the data object that should be anonymized.
example:
- user.name
- source.ip
items:
type: string
type: array
role:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatMessageRole'
description: The sender role of the message.
required:
- role
Security_AI_Assistant_API_FindPromptsSortField:
description: Field by which to sort the prompts.
enum:
- created_at
- is_default
- name
- updated_at
example: created_at
type: string
Security_AI_Assistant_API_PromptsBulkCrudActionResponse:
type: object
properties:
attributes:
type: object
properties:
errors:
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedPromptError'
type: array
results:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResults'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary'
required:
- results
- summary
message:
description: A message describing the result of the bulk action.
example: Bulk action completed successfully.
type: string
prompts_count:
description: The number of prompts processed in the bulk action.
example: 6
type: integer
status_code:
description: The HTTP status code of the response.
example: 200
type: integer
success:
description: Indicates if the bulk action was successful.
example: true
type: boolean
required:
- attributes
Security_AI_Assistant_API_IndexEntryRequiredFields:
type: object
properties:
description:
description: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
example: Query this index for general knowledge base content.
type: string
field:
description: Field to query for Knowledge Base content.
example: content
type: string
index:
description: Index or Data Stream to query for Knowledge Base content.
example: knowledge_base_index
type: string
queryDescription:
description: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
example: Search for documents containing the specified keywords.
type: string
type:
description: Entry type.
enum:
- index
example: index
type: string
required:
- type
- index
- field
- description
- queryDescription
Security_AI_Assistant_API_AnonymizationFieldCreateProps:
type: object
properties:
allowed:
description: Whether this field is allowed to be sent to the model.
example: true
type: boolean
anonymized:
description: Whether this field should be anonymized.
example: false
type: boolean
field:
description: Name of the anonymization field to create.
example: host.name
type: string
required:
- field
Security_AI_Assistant_API_Message:
description: AI assistant conversation message.
type: object
properties:
content:
description: Message content.
example: Hello, how can I assist you today?
type: string
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
description: Message id
isError:
description: Is error message.
example: false
type: boolean
metadata:
$ref: '#/components/schemas/Security_AI_Assistant_API_MessageMetadata'
description: Metadata
reader:
$ref: '#/components/schemas/Security_AI_Assistant_API_Reader'
description: Message content.
refusal:
description: Refusal reason returned by the model when content is filtered.
type: string
role:
$ref: '#/components/schemas/Security_AI_Assistant_API_MessageRole'
description: Message role.
example: assistant
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
description: The timestamp message was sent or received.
example: '2025-04-30T15:30:00Z'
traceData:
$ref: '#/components/schemas/Security_AI_Assistant_API_TraceData'
description: Trace data
user:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: The user who sent the message.
required:
- timestamp
- content
- role
Security_AI_Assistant_API_NormalizedAnonymizationFieldError:
type: object
properties:
anonymization_fields:
description: Array of anonymization fields that caused the error.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldDetailsInError'
type: array
err_code:
description: Error code indicating the type of failure.
example: UPDATE_FAILED
type: string
message:
description: Error message.
example: Failed to update anonymization field.
type: string
status_code:
description: Status code of the response.
example: 400
type: integer
required:
- message
- status_code
- anonymization_fields
Security_AI_Assistant_API_KnowledgeBaseResponse:
description: AI assistant KnowledgeBase.
type: object
properties:
success:
description: Identify the success of the method execution.
example: true
type: boolean
Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult:
type: object
properties:
id:
description: The ID of the anonymization field that was not modified.
example: field4
type: string
name:
description: Name of the anonymization field that was not modified.
example: user.name
type: string
skip_reason:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason'
description: Reason why the anonymization field was not modified.
required:
- id
- skip_reason
Security_AI_Assistant_API_SelectOptionInterruptResumeValue:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptResumeValue'
- type: object
properties:
type:
enum:
- SELECT_OPTION
example: SELECT_OPTION
type: string
value:
description: The value of the selected option to resume the graph execution with
example: option_1
type: string
required:
- value
- type
description: A request approval resume schema
Security_AI_Assistant_API_AnonymizationFieldUpdateProps:
type: object
properties:
allowed:
description: Whether this field is allowed to be sent to the model.
example: true
type: boolean
anonymized:
description: Whether this field should be anonymized.
example: false
type: boolean
id:
description: The ID of the anonymization field to update.
example: field8
type: string
required:
- id
Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField:
description: Fields available for sorting Knowledge Base Entries.
enum:
- created_at
- is_default
- title
- updated_at
example: title
type: string
Security_AI_Assistant_API_MessageMetadata:
description: Message metadata
type: object
properties:
contentReferences:
$ref: '#/components/schemas/Security_AI_Assistant_API_ContentReferences'
description: Data referred to by the message content.
interruptResumeValue:
$ref: '#/components/schemas/Security_AI_Assistant_API_InterruptResumeValue'
description: When the agent is resumed after an interrupt, this field is populated with the details of the resume value.
interruptValue:
$ref: '#/components/schemas/Security_AI_Assistant_API_InterruptValue'
description: When the agent is interrupted (for example, when user input is required), this field is populated with the details of the interrupt. Messages containing interruptValues in the metadata are excluded from the LLM context.
Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError:
type: object
properties:
err_code:
description: Specific error code for the issue.
example: UPDATE_FAILED
type: string
knowledgeBaseEntries:
description: List of Knowledge Base Entries that encountered the error.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError'
type: array
message:
description: Error message describing the issue.
example: Failed to update entry.
type: string
statusCode:
description: HTTP status code associated with the error.
example: 400
type: integer
required:
- message
- statusCode
- knowledgeBaseEntries
Security_AI_Assistant_API_AnonymizationFieldDetailsInError:
type: object
properties:
id:
description: The ID of the anonymization field.
example: field12
type: string
name:
description: Name of the anonymization field.
example: host.name
type: string
required:
- id
Security_AI_Assistant_API_IndexEntryResponseFields:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
Security_AI_Assistant_API_DeleteResponseFields:
type: object
properties:
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
required:
- id
Security_AI_Assistant_API_PromptsBulkCrudActionResults:
type: object
properties:
created:
description: List of prompts that were created.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
type: array
deleted:
description: List of IDs of prompts that were deleted.
items:
type: string
type: array
skipped:
description: List of prompts that were skipped.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipResult'
type: array
updated:
description: List of prompts that were updated.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
type: array
required:
- updated
- created
- deleted
- skipped
Security_AI_Assistant_API_SecurityAlertContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- type: object
properties:
alertId:
description: ID of the Alert
example: alert789
type: string
type:
enum:
- SecurityAlert
example: SecurityAlert
type: string
required:
- type
- alertId
description: References a security alert
Security_AI_Assistant_API_IndexEntryCreateFields:
allOf:
- type: object
properties:
global:
description: Whether this Knowledge Base Entry is global, defaults to false.
example: false
type: boolean
name:
description: Name of the Knowledge Base Entry.
example: Example Entry
type: string
namespace:
description: Kibana Space, defaults to 'default' space.
example: default
type: string
users:
description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- name
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults:
type: object
properties:
created:
description: List of Knowledge Base Entries that were successfully created.
example:
- id: '456'
kbResource: user
name: New Entry
source: manual
text: This is the content of the new entry.
type: document
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
type: array
deleted:
description: List of IDs of Knowledge Base Entries that were successfully deleted.
example:
- '789'
items:
type: string
type: array
skipped:
description: List of Knowledge Base Entries that were skipped during the bulk action.
example:
- id: '123'
name: Skipped Entry
skip_reason: KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult'
type: array
updated:
description: List of Knowledge Base Entries that were successfully updated.
example:
- id: '123'
kbResource: user
name: Updated Entry
source: manual
text: Updated content.
type: document
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
type: array
required:
- updated
- created
- deleted
- skipped
Security_AI_Assistant_API_DocumentEntryOptionalFields:
type: object
properties:
required:
description: Whether this resource should always be included, defaults to false.
example: false
type: boolean
vector:
$ref: '#/components/schemas/Security_AI_Assistant_API_Vector'
Security_AI_Assistant_API_Vector:
description: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
type: object
properties:
modelId:
description: ID of the model used to create the embeddings.
example: bert-base-uncased
type: string
tokens:
additionalProperties:
type: number
description: Tokens with their corresponding values.
example:
token1: 0.123
token2: 0.456
type: object
required:
- modelId
- tokens
Security_AI_Assistant_API_PromptsBulkActionSkipReason:
description: Reason why a prompt was skipped during the bulk action.
enum:
- PROMPT_FIELD_NOT_MODIFIED
type: string
Security_AI_Assistant_API_ApiConfig:
type: object
properties:
actionTypeId:
description: Action type ID
example: actionType456
type: string
connectorId:
description: Connector ID
example: connector123
type: string
defaultSystemPromptId:
description: Default system prompt ID
example: systemPrompt001
type: string
model:
description: Model
example: gpt-4
type: string
provider:
$ref: '#/components/schemas/Security_AI_Assistant_API_Provider'
description: Provider
example: OpenAI
required:
- connectorId
- actionTypeId
Security_AI_Assistant_API_DocumentEntryResponseFields:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
Security_AI_Assistant_API_Provider:
description: Provider
enum:
- OpenAI
- Azure OpenAI
- Other
example: OpenAI
type: string
Security_AI_Assistant_API_BulkCrudActionSummary:
type: object
properties:
failed:
description: The number of failed actions.
example: 0
type: integer
skipped:
description: The number of skipped actions.
example: 1
type: integer
succeeded:
description: The number of successfully performed actions.
example: 10
type: integer
total:
description: The total number of actions attempted.
example: 12
type: integer
required:
- failed
- skipped
- succeeded
- total
Security_AI_Assistant_API_IndexEntry:
allOf:
- type: object
properties:
global:
description: Whether this Knowledge Base Entry is global, defaults to false.
example: false
type: boolean
name:
description: Name of the Knowledge Base Entry.
example: Example Entry
type: string
namespace:
description: Kibana Space, defaults to 'default' space.
example: default
type: string
users:
description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- name
- namespace
- global
- users
- $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields'
Security_AI_Assistant_API_InputSchema:
description: Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
items:
type: object
properties:
description:
description: Description of the field.
example: The title of the document.
type: string
fieldName:
description: Name of the field.
example: title
type: string
fieldType:
description: Type of the field.
example: string
type: string
required:
- fieldName
- fieldType
- description
type: array
Security_AI_Assistant_API_DocumentEntryCreateFields:
allOf:
- type: object
properties:
global:
description: Whether this Knowledge Base Entry is global, defaults to false.
example: false
type: boolean
name:
description: Name of the Knowledge Base Entry.
example: Example Entry
type: string
namespace:
description: Kibana Space, defaults to 'default' space.
example: default
type: string
users:
description: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
type: array
required:
- name
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
Security_AI_Assistant_API_NonEmptyTimestamp:
description: A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
example: '2023-10-31T12:00:00Z'
format: nonempty
minLength: 1
type: string
Security_AI_Assistant_API_NormalizedPromptError:
type: object
properties:
err_code:
description: A code representing the error type.
type: string
message:
description: A message describing the error encountered.
type: string
prompts:
description: List of prompts that encountered errors.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptDetailsInError'
type: array
status_code:
description: The HTTP status code associated with the error.
type: integer
required:
- message
- status_code
- prompts
securitySchemes:
apiKeyAuth:
description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
'
in: header
name: Authorization
type: apiKey
basicAuth:
scheme: basic
type: http
x-topics:
- title: Kibana spaces
content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"