openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Endpoint Management API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Interact with and manage endpoints running the Elastic Defend integration.
  name: Security Endpoint Management API
  x-displayName: Security endpoint management
paths:
  /api/endpoint/action:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all response actions.'
      operationId: EndpointGetActionsList
      parameters:
      - in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
      - in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
      - in: query
        name: commands
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Commands'
      - in: query
        name: agentIds
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
      - in: query
        name: userIds
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_UserIds'
      - in: query
        name: startDate
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_StartDate'
      - in: query
        name: endDate
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndDate'
      - in: query
        name: agentTypes
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
      - in: query
        name: withOutputs
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_WithOutputs'
      - in: query
        name: types
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Types'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_GetEndpointActionListResponse'
          description: Indicates a successful call.
      summary: Get response actions
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action_status:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action_status</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the status of response actions for the specified agent IDs.'
      operationId: EndpointGetActionsStatus
      parameters:
      - description: A list of agent IDs to get the action status for.
        in: query
        name: agent_ids
        required: true
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStatusSuccessResponse'
          description: Indicates a successful call.
      summary: Get response actions status
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/{action_id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a response action using the action ID.'
      operationId: EndpointGetActionsDetails
      parameters:
      - in: path
        name: action_id
        required: true
        schema:
          description: The ID of the action to retrieve.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionDetailsResponse'
          description: OK
      summary: Get action details
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/{action_id}/file/{file_id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get information for the specified response action file download.

        '
      operationId: EndpointFileInfo
      parameters:
      - description: The ID of the response action that generated the file.
        in: path
        name: action_id
        required: true
        schema:
          type: string
      - description: 'The file identifier is constructed in one of two ways:

          - For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:

          `{file_id}` = `{action_id}.{agent_id}`

          - For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.

          '
        in: path
        name: file_id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    type: object
                    properties:
                      actionId:
                        description: The response action ID.
                        type: string
                      agentId:
                        description: The agent ID that generated the file.
                        type: string
                      agentType:
                        description: The type of agent that generated the file.
                        type: string
                      created:
                        description: The date and time the file was created.
                        format: date-time
                        type: string
                      id:
                        description: The unique file identifier.
                        type: string
                      mimeType:
                        description: The MIME type of the file.
                        type: string
                      name:
                        description: The file name.
                        type: string
                      size:
                        description: The file size in bytes.
                        type: number
                      status:
                        description: The file upload status.
                        enum:
                        - AWAITING_UPLOAD
                        - UPLOADING
                        - READY
                        - UPLOAD_ERROR
                        - DELETED
                        type: string
          description: Indicates a successful call.
      summary: Get file information
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/{action_id}/file/{file_id}/download:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.

        > info

        > Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system''s password.

        '
      operationId: EndpointFileDownload
      parameters:
      - description: The ID of the response action that generated the file.
        in: path
        name: action_id
        required: true
        schema:
          type: string
      - description: 'The file identifier is constructed in one of two ways:

          - For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:

          `{file_id}` = `{action_id}.{agent_id}`

          - For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.

          '
        in: path
        name: file_id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/octet-stream:
              schema:
                format: binary
                type: string
          description: Indicates a successful call.
      summary: Download a file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/cancel:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/cancel</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Cancel a running or pending response action (Applies only to some agent types).'
      operationId: CancelAction
      requestBody:
        content:
          application/json:
            examples:
              MicrosoftDefenderEndpoint:
                summary: Cancel a response action on a Microsoft Defender for Endpoint host
                value:
                  agent_type: microsoft_defender_endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CancelSuccess:
                  summary: Cancel action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: microsoft_defender_endpoint
                      command: cancel
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Cancel a response action
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/execute:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/execute</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Run a shell command on an endpoint.'
      operationId: EndpointExecuteAction
      requestBody:
        content:
          application/json:
            examples:
              executeCommand:
                summary: Execute a shell command on an endpoint
                value:
                  comment: Get list of all files
                  endpoint_ids:
                  - b3d6de74-36b0-4fa8-be46-c375bf1771bf
                  parameters:
                    command: ls -al
                    timeout: 600
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ExecuteRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ExecuteSuccess:
                  summary: Execute action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: execute
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 9f934028-2300-4927-b531-b26376793dc4
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        command: ls -al
                        timeout: 600
                      startedAt: '2023-07-28T18:43:27.362Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Run a command
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/get_file:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/get_file</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a file from an endpoint.'
      operationId: EndpointGetFileAction
      requestBody:
        content:
          application/json:
            examples:
              getFile:
                summary: Get a specific file from an endpoint
                value:
                  comment: Get my file
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFileRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                GetFileSuccess:
                  summary: Get file action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: get-file
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Get a file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/isolate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/isolate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Isolate an endpoint from the network. The endpoint remains isolated until it''s released.'
      operationId: EndpointIsolateAction
      requestBody:
        content:
          application/json:
            examples:
              multiple_endpoints:
                summary: Isolates several hosts; includes a comment
                value:
                  comment: Locked down, pending further investigation
                  endpoint_ids:
                  - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                  - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                  - fa89271b-b9d4-43f2-a684-307cffddeb5a
              single_endpoint:
                summary: Isolates a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
              with_case_id:
                summary: Isolates a single host with a case_id value of 1234
                value:
                  case_ids:
                  - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Isolating as initial response
                  endpoint_ids:
                  - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                  - b30a11bf-1395-4707-b508-fbb45ef9793e
            schema:
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
                  example:
                  - alert-id-1
                  - alert-id-2
                  items:
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                case_ids:
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                  - case-id-1
                  - case-id-2
                  items:
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
              required:
              - endpoint_ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                IsolateSuccess:
                  summary: Isolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: isolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_IsolateRouteResponse'
          description: Indicates a successful call.
      summary: Isolate an endpoint
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/kill_process:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/kill_process</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Terminate a running process on an endpoint.'
      operationId: EndpointKillProcessAction
      requestBody:
        content:
          application/json:
            examples:
              byEntityId:
                summary: Terminate a process by entity ID
                value:
                  comment: Terminating malicious process
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Terminate a process by PID
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcessRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                KillProcessSuccess:
                  summary: Kill process action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: kill-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Terminate a process
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/memory_dump:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/memory_dump</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Generates memory dumps on the targeted host.'
      operationId: EndpointGenerateMemoryDump
      requestBody:
        content:
          application/json:
            examples:
              ProcessMemoryDump:
                summary: Generate a memory dump from the host machine
                value:
                  agent_type: endpoint
                  comment: Generating memory dump for investigation
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
                    type: process
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDumpRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                MemoryDumpSuccessResponse:
                  summary: Memory dump action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: memory-dump
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                        type: process
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Generate a memory dump from the host machine
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/running_procs:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/running_procs</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all processes running on an endpoint.'
      operationId: EndpointGetProcessesAction
      requestBody:
        content:
          application/json:
            examples:
              singleEndpoint:
                summary: Get running processes on a single endpoint
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetProcessesRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                RunningProcsSuccess:
                  summary: Running processes action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: running-processes
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Get running processes
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/runscript:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/runscript</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Run a script on a host. Currently supported only for some agent types.'
      operationId: RunScriptAction
      requestBody:
        content:
          application/json:
            examples:
              MDE:
                description: Microsoft Defender Endpoint runscript
                summary: Run a script against a Microsoft Defender Endpoint agent
                value:
                  agent_type: microsoft_defender_endpoint
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    args: -param1 value1 -param2 value2
                    scriptName: my-script.ps1
              SentinelOne:
                description: SentinelOne runscript
                summary: Run a script against a SentinelOne agent
                value:
                  agent_type: sentinel_one
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: --delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_RunScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                RunScriptSuccess:
                  summary: Run script action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: sentinel_one
                      command: runscript
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Run a script
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/scan:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/scan</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Scan a specific file or directory on an endpoint for malware.'
      operationId: EndpointScanAction
      requestBody:
        content:
          application/json:
            examples:
              scanFile:
                summary: Scan a file on an endpoint
                value:
                  comment: Scan the file for malware
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ScanRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ScanSuccess:
                  summary: Scan action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: scan
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Scan a file or directory
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/state:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/state</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a response actions state, which reports whether encryption is enabled.'
      operationId: EndpointGetActionsState
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStateSuccessResponse'
          description: OK
      summary: Get actions state
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/suspend_process:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/suspend_process</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Suspend a running process on an endpoint.'
      operationId: EndpointSuspendProcessAction
      requestBody:
        content:
          application/json:
            examples:
              byEntityId:
                summary: Suspend a process by entity ID
                value:
                  comment: Suspending suspicious process
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Suspend a process by PID
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcessRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                SuspendProcessSuccess:
                  summary: Suspend process action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: suspend-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Suspend a process
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/unisolate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/unisolate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Release an isolated endpoint, allowing it to rejoin a network.'
      operationId: EndpointUnisolateAction
      requestBody:
        content:
          application/json:
            examples:
              multipleHosts:
                summary: 'Releases several hosts; includes a comment:'
                value:
                  comment: Benign process identified, releasing group
                  endpoint_ids:
                  - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                  - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                  - fa89271b-b9d4-43f2-a684-307cffddeb5a
              singleHost:
                summary: Releases a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                  - ed518850-681a-4d60-bb98-e22640cae2a8
              withCaseId:
                summary: Releases hosts with an associated case; includes a comment.
                value:
                  case_ids:
                  - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Remediation complete, restoring network
                  endpoint_ids:
                  - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                  - b30a11bf-1395-4707-b508-fbb45ef9793e
            schema:
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
                  example:
                  - alert-id-1
                  - alert-id-2
                  items:
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                case_ids:
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                  - case-id-1
                  - case-id-2
                  items:
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
              required:
              - endpoint_ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UnisolateSuccess:
                  summary: Unisolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: unisolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_UnisolateRouteResponse'
          description: Indicates a successful call.
      summary: Release an isolated endpoint
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/action/upload:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/upload</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Upload a file to an endpoint.'
      operationId: EndpointUploadAction
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_UploadRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UploadSuccess:
                  summary: Upload action successfully created
                  value:
                    data:
                      agents:
                      - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: upload
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: Host-5i6cuc8kdv
                      id: 9ff6aebc-2cb6-481e-8869-9b30036c9731
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        file_id: 10e4ce3d-4abb-4f93-a0cd-eaf63a489280
                        file_name: fix-malware.sh
                        file_sha256: a0bed94220193ba4895c0aa5b4e7e293381d15765cb164ddf7be5cdd010ae42a
                        file_size: 69
                      startedAt: '2023-07-03T15:07:22.837Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Upload a file
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/metadata:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/metadata</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all endpoint host metadata.'
      operationId: GetEndpointMetadataList
      parameters:
      - in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
      - in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
      - in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
      - in: query
        name: hostStatuses
        required: true
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_HostStatuses'
      - in: query
        name: sortField
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_SortField'
      - in: query
        name: sortDirection
        required: false
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_MetadataListResponse'
          description: Indicates a successful call.
      summary: Get a metadata list
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/metadata/{id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/metadata/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get host metadata for a specific endpoint.'
      operationId: GetEndpointMetadata
      parameters:
      - description: The agent ID of the endpoint.
        in: path
        name: id
        required: true
        schema:
          example: ed518850-681a-4d60-bb98-e22640cae2a8
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointMetadataResponse'
          description: Indicates a successful call.
      summary: Get metadata
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/policy_response:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/policy_response</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the most recent policy response for an endpoint.'
      operationId: GetPolicyResponse
      parameters:
      - description: The agent ID to retrieve the policy response for.
        in: query
        name: agentId
        required: true
        schema:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_SuccessResponse'
          description: Indicates a successful call.
      summary: Get a policy response
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/endpoint/protection_updates_note/{package_policy_id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the protection updates note for a package policy.'
      operationId: GetProtectionUpdatesNote
      parameters:
      - description: The package policy ID to retrieve the protection updates note for.
        in: path
        name: package_policy_id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
          description: Indicates a successful call.
      summary: Get a protection updates note
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create or update the protection updates note for a package policy.'
      operationId: CreateUpdateProtectionUpdatesNote
      parameters:
      - description: The package policy ID to create or update the protection updates note for.
        in: path
        name: package_policy_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                note:
                  description: The note content.
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
          description: Indicates a successful call.
      summary: Create or update a protection updates note
      tags:
      - Security Endpoint Management API
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Endpoint_Management_API_RunscriptParamsCrowdStrike:
      type: object
      properties:
        cloudFile:
          type: string
        commandLine:
          type: string
        hostPath:
          type: string
        raw:
          type: string
        timeout:
          type: number
    Security_Endpoint_Management_API_ActionDetailsResponse:
      discriminator:
        mapping:
          cancel: '#/components/schemas/Security_Endpoint_Management_API_Cancel'
          execute: '#/components/schemas/Security_Endpoint_Management_API_Execute'
          get-file: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
          isolate: '#/components/schemas/Security_Endpoint_Management_API_Isolate'
          kill-process: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
          memory-dump: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
          running-processes: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
          runscript: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
          scan: '#/components/schemas/Security_Endpoint_Management_API_Scan'
          suspend-process: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
          unisolate: '#/components/schemas/Security_Endpoint_Management_API_Unisolate'
          upload: '#/components/schemas/Security_Endpoint_Management_API_Upload'
        propertyName: command
      oneOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Execute'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Upload'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Scan'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Cancel'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Isolate'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_Unisolate'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
    Security_Endpoint_Management_API_Isolate:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - description: Details of an isolate action response.
        type: object
    Security_Endpoint_Management_API_SuccessResponse:
      description: A generic successful response.
      type: object
    Security_Endpoint_Management_API_Comment:
      description: Optional comment
      example: This is a comment
      type: string
    Security_Endpoint_Management_API_PendingActionsSchema:
      oneOf:
      - type: object
        properties:
          execute:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending execute actions.
          get-file:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending get-file actions.
          isolate:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending isolate actions.
          kill-process:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending kill-process actions.
          running-processes:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending running-processes (get processes) actions.
          scan:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending scan actions.
          suspend-process:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending suspend-process actions.
          unisolate:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending unisolate (release) actions.
          upload:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            description: Number of pending upload actions.
      - additionalProperties: true
        type: object
    Security_Endpoint_Management_API_SortField:
      description: Determines which field is used to sort the results.
      enum:
      - enrolled_at
      - metadata.host.hostname
      - host_status
      - metadata.Endpoint.policy.applied.name
      - metadata.Endpoint.policy.applied.status
      - metadata.host.os.name
      - metadata.host.ip
      - metadata.agent.version
      - last_checkin
      example: enrolled_at
      type: string
    Security_Endpoint_Management_API_HostStatuses:
      description: A set of agent health statuses to filter by.
      example:
      - healthy
      - updating
      items:
        enum:
        - healthy
        - offline
        - updating
        - inactive
        - unenrolled
        type: string
      maxItems: 20
      type: array
    Security_Endpoint_Management_API_EndDate:
      description: An end date in ISO format or Date Math format.
      example: '2023-10-31T23:59:59.999Z'
      type: string
    Security_Endpoint_Management_API_RunscriptParamsSentinelOne:
      type: object
      properties:
        scriptId:
          type: string
        scriptInput:
          type: string
    Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse:
      example:
        data:
          agents:
          - ed518850-681a-4d60-bb98-e22640cae2a8
          agentState:
            ed518850-681a-4d60-bb98-e22640cae2a8:
              isCompleted: false
              wasSuccessful: false
          agentType: __agent__type__here_
          command: __command__name__here__
          createdBy: elastic
          hosts:
            ed518850-681a-4d60-bb98-e22640cae2a8:
              name: gke-node-1235412
          id: 233db9ea-6733-4849-9226-5a7039c7161d
          isCompleted: false
          isExpired: false
          outputs: {}
          parameters: {}
          startedAt: '2022-07-29T19:08:49.126Z'
          status: pending
          wasSuccessful: false
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_Runscript:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  allOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                  - type: object
                    properties:
                      code:
                        type: string
                      stderr:
                        type: string
                      stdout:
                        type: string
            type: object
          parameters:
            oneOf:
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsCrowdStrike'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsMicrosoft'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsSentinelOne'
    Security_Endpoint_Management_API_Scan:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  type: object
                  properties:
                    code:
                      type: string
            type: object
          parameters:
            type: object
            properties:
              path:
                type: string
    Security_Endpoint_Management_API_Page:
      default: 1
      description: Page number
      example: 1
      minimum: 1
      type: integer
    Security_Endpoint_Management_API_UnisolateRouteResponse:
      type: object
      properties:
        action:
          description: The action ID (legacy field, same as `data.id`).
          type: string
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_SuspendProcess:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  oneOf:
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      pid:
                        type: number
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      entity_id:
                        type: string
            type: object
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to terminate.
                  minimum: 1
                  type: number
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to terminate.
                  minLength: 1
                  type: string
    Security_Endpoint_Management_API_CancelRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              id:
                description: ID of the response action to cancel
                example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
                minLength: 1
                type: string
            required:
            - id
        required:
        - parameters
    Security_Endpoint_Management_API_Cancel:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  type: object
                  properties:
                    code:
                      type: string
            type: object
          parameters:
            type: object
            properties:
              id:
                format: uuid
                type: string
    Security_Endpoint_Management_API_AgentTypes:
      description: List of agent types to retrieve. Defaults to `endpoint`.
      enum:
      - endpoint
      - sentinel_one
      - crowdstrike
      - microsoft_defender_endpoint
      example: endpoint
      type: string
    Security_Endpoint_Management_API_IsolateRouteResponse:
      type: object
      properties:
        action:
          description: The action ID (legacy field, same as `data.id`).
          type: string
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_SuspendProcessRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to suspend.
                  example: 123
                  minimum: 1
                  type: integer
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to suspend.
                  example: abc123
                  minLength: 1
                  type: string
        required:
        - parameters
    Security_Endpoint_Management_API_StartDate:
      description: A start date in ISO 8601 format or Date Math format.
      example: '2023-10-31T00:00:00.000Z'
      type: string
    Security_Endpoint_Management_API_DownloadUri:
      type: object
      properties:
        downloadUri:
          description: 'The server relative URI to download the file associated with the output of the response action.

            URI does **not** include the space prefix

            '
          example: /api/endpoint/action/497f6eca-6276/file/35645-6276-4993/download
          format: uri-reference
          type: string
    Security_Endpoint_Management_API_WithOutputs:
      description: A list of action IDs that should include the complete output of the action. Max of 50.
      example:
      - action-id-1
      - action-id-2
      oneOf:
      - items:
          minLength: 1
          type: string
        maxItems: 50
        minItems: 1
        type: array
      - minLength: 1
        type: string
    Security_Endpoint_Management_API_AgentIds:
      description: A list of agent IDs. Max of 250.
      example:
      - agent-id-1
      - agent-id-2
      minLength: 1
      oneOf:
      - items:
          minLength: 1
          type: string
        maxItems: 250
        minItems: 1
        type: array
      - minLength: 1
        type: string
    Security_Endpoint_Management_API_RunningProcesses:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputEndpoint'
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne'
            type: object
    Security_Endpoint_Management_API_Command:
      description: The command for the response action
      enum:
      - isolate
      - unisolate
      - kill-process
      - suspend-process
      - running-processes
      - get-file
      - execute
      - upload
      - scan
      - runscript
      - cancel
      - memory-dump
      minLength: 1
      type: string
    Security_Endpoint_Management_API_UserIds:
      description: A list of user IDs. Max of 50.
      example:
      - user-id-1
      - user-id-2
      oneOf:
      - items:
          minLength: 1
          type: string
        maxItems: 50
        minItems: 1
        type: array
      - minLength: 1
        type: string
    Security_Endpoint_Management_API_SortDirection:
      description: Determines the sort order.
      enum:
      - asc
      - desc
      example: desc
      type: string
    Security_Endpoint_Management_API_EndpointIds:
      description: List of endpoint IDs (cannot contain empty strings). Max of 250.
      example:
      - endpoint-id-1
      - endpoint-id-2
      items:
        minLength: 1
        type: string
      maxItems: 250
      minItems: 1
      type: array
    Security_Endpoint_Management_API_Kuery:
      description: A KQL string.
      example: 'united.endpoint.host.os.name : ''Windows'''
      type: string
    Security_Endpoint_Management_API_KillProcess:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  oneOf:
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      pid:
                        type: number
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      entity_id:
                        type: string
                  - type: object
                    properties:
                      code:
                        type: string
                      command:
                        type: string
                      process_name:
                        type: string
            type: object
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to terminate.
                  minimum: 1
                  type: number
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to terminate.
                  minLength: 1
                  type: string
            - type: object
              properties:
                process_name:
                  description: The name of the process to terminate. Valid for SentinelOne agent type only.
                  type: string
    Security_Endpoint_Management_API_AgentId:
      description: Agent ID
      type: string
    Security_Endpoint_Management_API_PageSize:
      default: 10
      description: Number of items per page
      example: 10
      maximum: 100
      minimum: 1
      type: integer
    Security_Endpoint_Management_API_SentinelOneRunScriptParameters:
      description: Parameters for Run Script response action against SentinelOne agent type.
      example:
        agent_type: sentinel_one
        endpoint_ids:
        - endpoint-id-1
        parameters:
          scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
          scriptInput: --delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt
      properties:
        scriptId:
          description: The script ID from SentinelOne scripts library that will be executed.
          minLength: 1
          type: string
        scriptInput:
          description: The input parameter arguments for the script that was selected.
          minLength: 1
          type: string
      required:
      - scriptId
      title: SentinelOne Run Script Parameters
      type: object
    Security_Endpoint_Management_API_GetEndpointActionListResponse:
      example:
        data:
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: running-processes
          completedAt: '2022-08-08T09:50:47.672Z'
          createdBy: elastic
          id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T15:24:57.402Z'
          wasSuccessful: true
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: isolate
          completedAt: '2022-08-08T10:41:57.352Z'
          createdBy: elastic
          id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T15:23:37.359Z'
          wasSuccessful: true
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: kill-process
          comment: bad process - taking up too much cpu
          completedAt: '2022-08-08T09:44:50.952Z'
          createdBy: elastic
          id: 5bc92c86-b8e6-42dd-837f-12ad29e09caa
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T14:38:44.125Z'
          wasSuccessful: true
        - agents:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
          agentType: endpoint
          command: unisolate
          comment: Not a threat to the network
          completedAt: '2022-08-08T09:40:47.398Z'
          createdBy: elastic
          id: 790d54e0-3aa3-4e5b-8255-3ce9d851246a
          isCompleted: true
          isExpired: false
          startedAt: '2022-08-08T14:38:15.391Z'
          wasSuccessful: true
        elasticAgentIds:
        - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
        endDate: now
        page: 1
        pageSize: 10
        startDate: now-24h/h
        total: 4
      type: object
      properties:
        agentTypes:
          description: The list of agent types the query was filtered by.
          items:
            type: string
          type: array
        commands:
          description: The list of commands the query was filtered by.
          items:
            type: string
          type: array
        data:
          description: The list of response actions.
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
          type: array
        elasticAgentIds:
          description: The list of elastic agent IDs the query was filtered by.
          items:
            type: string
          type: array
        endDate:
          description: The end date filter applied to the query.
          type: string
        page:
          description: The current page number.
          type: integer
        pageSize:
          description: The number of items per page.
          type: integer
        startDate:
          description: The start date filter applied to the query.
          type: string
        statuses:
          description: The list of statuses the query was filtered by.
          items:
            type: string
          type: array
        total:
          description: The total number of response actions matching the query.
          type: integer
        userIds:
          description: The list of user IDs the query was filtered by.
          items:
            type: string
          type: array
    Security_Endpoint_Management_API_UploadRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          file:
            description: The binary content of the file.
            example: RWxhc3RpYw==
            format: binary
            type: string
          parameters:
            type: object
            properties:
              overwrite:
                default: false
                description: Overwrite the file on the host if it already exists.
                example: false
                type: boolean
        required:
        - parameters
        - file
    Security_Endpoint_Management_API_Commands:
      description: A list of response action command names.
      example:
      - isolate
      - unisolate
      items:
        $ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
      maxItems: 50
      type: array
    Security_Endpoint_Management_API_KillProcessRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - type: object
              properties:
                pid:
                  description: The process ID (PID) of the process to terminate.
                  example: 123
                  minimum: 1
                  type: integer
            - type: object
              properties:
                entity_id:
                  description: The entity ID of the process to terminate.
                  example: abc123
                  minLength: 1
                  type: string
            - type: object
              properties:
                process_name:
                  description: The name of the process to terminate. Valid for SentinelOne agent type only.
                  example: Elastic
                  minLength: 1
                  type: string
        required:
        - parameters
    Security_Endpoint_Management_API_EndpointMetadataResponse:
      example:
        host_status: healthy
        last_checkin: '2023-07-04T15:48:57.360Z'
        metadata:
          '@timestamp': '2023-07-04T15:48:57.3609346Z'
          agent:
            build:
              original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
            id: abb8a826-6812-448c-a571-6d8269b51449
            type: endpoint
            version: 7.16.0
          data_stream:
            dataset: endpoint.metadata
            namespace: default
            type: metrics
          ecs:
            version: 1.11.0
          elastic:
            agent:
              id: abb8a826-6812-448c-a571-6d8269b51449
          Endpoint:
            capabilities:
            - isolation
            configuration:
              isolation: false
            policy:
              applied:
                endpoint_policy_version: '2'
                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                name: test
                status: success
                version: '3'
            state:
              isolation: false
            status: enrolled
          event:
            action: endpoint_metadata
            agent_id_status: verified
            category:
            - host
            created: '2023-07-04T15:48:57.3609346Z'
            dataset: endpoint.metadata
            id: MNtRc++KoKHXXwlj+++++OhZ
            ingested: '2023-07-04T15:48:58Z'
            kind: metric
            module: endpoint
            sequence: 43757
            type:
            - info
          host:
            architecture: x86_64
            hostname: WinDev2104Eval
            id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
            ip:
            - 10.0.2.15
            - fe80::21a6:63d3:d70e:e3ad
            - 127.0.0.1
            - ::1
            mac:
            - 08:00:27:b1:1d:5a
            name: WinDev2104Eval
            os:
              Ext:
                variant: Windows 10 Enterprise Evaluation
              family: windows
              full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
              kernel: 20H2 (10.0.19042.906)
              name: Windows
              platform: windows
              type: windows
              version: 20H2 (10.0.19042.906)
          message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
      type: object
      properties: {}
    Security_Endpoint_Management_API_Type:
      description: Type of response action
      enum:
      - automated
      - manual
      type: string
    Security_Endpoint_Management_API_MemoryDumpRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            oneOf:
            - description: Dump the entire kernel memory.
              type: object
              properties:
                type:
                  enum:
                  - kernel
                  type: string
              required:
              - type
            - description: Dump the entire memory of a process using the PID.
              type: object
              properties:
                pid:
                  type: number
                type:
                  enum:
                  - process
                  type: string
              required:
              - type
              - pid
            - description: Dump the entire memory of a process using the entity ID.
              type: object
              properties:
                entity_id:
                  type: string
                type:
                  enum:
                  - process
                  type: string
              required:
              - type
              - entity_id
        required:
        - parameters
    Security_Endpoint_Management_API_ResponseActionDetails:
      type: object
      properties:
        agents:
          description: The agent IDs for the hosts that the response action was sent to
          items:
            format: uuid
            type: string
          type: array
        agentState:
          additionalProperties:
            format: uuid
            type: object
            properties:
              completedAt:
                description: The date and time the response action was completed for the agent ID
                type: string
              isCompleted:
                description: Whether the response action is completed for the agent ID
                type: boolean
              wasSuccessful:
                description: Whether the response action was successful for the agent ID
                type: boolean
          description: The state of the response action for each agent ID that it was sent to
          type: object
        agentType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        command:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
        completedAt:
          description: The response action completion time
          format: date-time
          type: string
        createdBy:
          description: The user who created the response action
          type: string
        hosts:
          additionalProperties:
            format: uuid
            type: object
            properties:
              name:
                description: The host name
                type: string
          description: An object containing the host names associated with the agent IDs the response action was sent to
          type: object
        id:
          description: The response action ID
          format: uuid
          type: string
        isComplete:
          description: Whether the response action is complete
          type: boolean
        isExpired:
          description: Whether the response action is expired
          type: boolean
        outputs:
          additionalProperties:
            description: The agent id
            format: uuid
            properties:
              content:
                description: The response action output content for the agent ID. Exact format depends on the response action command.
                oneOf:
                - type: object
                - type: string
              type:
                enum:
                - json
                - text
                type: string
            required:
            - type
            - content
            title: Agent ID
            type: object
          description: 'The outputs of the response action for each agent ID that it was sent to. Content different depending on the

            response action command and will only be present for agents that have responded to the response action

            '
          type: object
        parameters:
          description: The parameters of the response action. Content different depending on the response action command
          type: object
        startedAt:
          description: The response action start time
          format: date-time
          type: string
        status:
          description: The response action status
          type: string
        wasSuccessful:
          description: Whether the response action was successful
          type: boolean
      required:
      - command
    Security_Endpoint_Management_API_MDERunScriptParameters:
      description: Parameters for Run Script response action against Microsoft Defender Endpoint agent type.
      example:
        agent_type: microsoft_defender_endpoint
        endpoint_ids:
        - endpoint-id-1
        parameters:
          args: -param1 value1 -param2 value2
          scriptName: my-script.ps1
      properties:
        args:
          description: Optional command line arguments for the script.
          minLength: 1
          type: string
        scriptName:
          description: The name of the script to execute from the cloud storage.
          minLength: 1
          type: string
      required:
      - scriptName
      title: Microsoft Defender Endpoint Run Script Parameters
      type: object
    Security_Endpoint_Management_API_ExecuteRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              command:
                description: The shell command to execute on the endpoint.
                minLength: 1
                type: string
              timeout:
                description: The maximum timeout value in seconds before the command is terminated.
                minimum: 1
                type: integer
            required:
            - command
        required:
        - parameters
    Security_Endpoint_Management_API_Types:
      description: List of types of response actions
      example:
      - automated
      - manual
      items:
        $ref: '#/components/schemas/Security_Endpoint_Management_API_Type'
      maxLength: 2
      minLength: 1
      type: array
    Security_Endpoint_Management_API_MemoryDump:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  properties:
                    code:
                      type: string
                    disk_free_space:
                      description: The free space on the host machine in bytes after the memory dump is written to disk
                      type: number
                    file_size:
                      description: The size of the memory dump compressed file in bytes
                      type: string
                    path:
                      description: The path to the memory dump compressed file on the host machine
                      type: string
                  title: Memory dump output
                  type: object
            type: object
          parameters:
            oneOf:
            - properties:
                type:
                  description: Kernel-level memory dump
                  enum:
                  - kernel
                  type: string
              required:
              - type
              title: Kernel memory dump
              type: object
            - properties:
                pid:
                  description: The process ID (PID)
                  type: number
                type:
                  description: Process-level memory dump using a process ID
                  enum:
                  - process
                  type: string
              required:
              - type
              - pid
              title: Process memory dump with PID
              type: object
            - properties:
                entity_id:
                  description: The process entity ID
                  type: string
                type:
                  description: Process-level memory dump using an entity ID
                  enum:
                  - process
                  type: string
              required:
              - type
              - entity_id
              title: Process memory dump with entity ID
              type: object
        required:
        - parameters
    Security_Endpoint_Management_API_Upload:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  type: object
                  properties:
                    code:
                      type: string
                    disk_free_space:
                      type: number
                    path:
                      type: string
            type: object
          parameters:
            description: 'The parameters for upload returned on the details are derived via the API from the file that

              was uploaded at the time that the response action was submitted

              '
            type: object
            properties:
              file_id:
                type: string
              file_name:
                type: string
              file_sha256:
                type: string
              file_size:
                type: number
    Security_Endpoint_Management_API_Execute:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  allOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                  - type: object
                    properties:
                      code:
                        type: string
                      cwd:
                        type: string
                      output_file_id:
                        type: string
                      output_file_stderr_truncated:
                        type: boolean
                      output_file_stdout_truncated:
                        type: boolean
                      shell_code:
                        type: number
                      stderr:
                        type: string
                      stderr_truncated:
                        type: boolean
                      stdout:
                        type: string
                      stdout_truncated:
                        type: boolean
            type: object
          parameters:
            type: object
            properties:
              command:
                type: string
              timeout:
                type: number
    Security_Endpoint_Management_API_Unisolate:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - description: Details of an unisolate action response.
        type: object
    Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
      - description: Processes output for `agentType` of `sentinel_one`
        type: object
        properties:
          code:
            type: string
    Security_Endpoint_Management_API_GetProcessesRouteRequestBody:
      type: object
      properties:
        agent_type:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        alert_ids:
          description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
          example:
          - alert-id-1
          - alert-id-2
          items:
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
        case_ids:
          description: The IDs of cases where the action taken will be logged. Max of 50.
          example:
          - case-id-1
          - case-id-2
          items:
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
        comment:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
        endpoint_ids:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
        parameters:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
      required:
      - endpoint_ids
    Security_Endpoint_Management_API_ActionStateSuccessResponse:
      type: object
      properties:
        body:
          type: object
          properties:
            data:
              type: object
              properties:
                canEncrypt:
                  description: Whether the Kibana instance has encryption enabled for response actions.
                  type: boolean
          required:
          - data
      required:
      - body
    Security_Endpoint_Management_API_ScanRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              path:
                description: The folder or file's full path (including the file name).
                example: /usr/my-file.txt
                type: string
            required:
            - path
        required:
        - parameters
    Security_Endpoint_Management_API_RunningProcessesOutputEndpoint:
      description: Processes output for `agentType` of `endpoint`
      type: object
      properties:
        code:
          type: string
        entries:
          items:
            type: object
            properties:
              command:
                type: string
              entity_id:
                type: string
              pid:
                type: number
              user:
                type: string
          type: array
    Security_Endpoint_Management_API_HostPathScriptParameters:
      type: object
      properties:
        commandLine:
          description: Command line arguments.
          minLength: 1
          type: string
        hostPath:
          description: Absolute or relative path of script on host machine.
          minLength: 1
          type: string
        timeout:
          description: Timeout in seconds.
          minimum: 1
          type: integer
      required:
      - hostPath
    Security_Endpoint_Management_API_GetFile:
      allOf:
      - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      - type: object
        properties:
          outputs:
            additionalProperties:
              type: object
              properties:
                content:
                  allOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                  - type: object
                    properties:
                      code:
                        type: string
                      contents:
                        items:
                          type: object
                          properties:
                            file_name:
                              type: string
                            path:
                              type: string
                            sha256:
                              type: string
                            size:
                              type: number
                            type:
                              type: string
                        type: array
                      zip_size:
                        type: number
            type: object
          parameters:
            type: object
            properties:
              path:
                type: string
    Security_Endpoint_Management_API_RunscriptParamsMicrosoft:
      type: object
      properties:
        args:
          type: string
        scriptName:
          type: string
    Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse:
      type: object
      properties:
        note:
          description: A note associated with the protection updates for the given package policy.
          type: string
    Security_Endpoint_Management_API_ActionStatusSuccessResponse:
      type: object
      properties:
        body:
          type: object
          properties:
            data:
              type: object
              properties:
                agent_id:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
                pending_actions:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionsSchema'
              required:
              - agent_id
              - pending_actions
          required:
          - data
      required:
      - body
    Security_Endpoint_Management_API_RawScriptParameters:
      type: object
      properties:
        commandLine:
          description: Command line arguments.
          minLength: 1
          type: string
        raw:
          description: Raw script content.
          minLength: 1
          type: string
        timeout:
          description: Timeout in seconds.
          minimum: 1
          type: integer
      required:
      - raw
    Security_Endpoint_Management_API_RunScriptRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            description: 'One of the following set of parameters must be provided

              '
            oneOf:
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_RawScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_HostPathScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_CloudFileScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_SentinelOneRunScriptParameters'
            - $ref: '#/components/schemas/Security_Endpoint_Management_API_MDERunScriptParameters'
        required:
        - parameters
    Security_Endpoint_Management_API_CloudFileScriptParameters:
      type: object
      properties:
        cloudFile:
          description: Script name in cloud storage.
          minLength: 1
          type: string
        commandLine:
          description: Command line arguments.
          minLength: 1
          type: string
        timeout:
          description: Timeout in seconds.
          minimum: 1
          type: integer
      required:
      - cloudFile
    Security_Endpoint_Management_API_PendingActionDataType:
      description: Number of pending actions of this type.
      type: integer
    Security_Endpoint_Management_API_GetFileRouteRequestBody:
      allOf:
      - type: object
        properties:
          agent_type:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
          alert_ids:
            description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
            example:
            - alert-id-1
            - alert-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          case_ids:
            description: The IDs of cases where the action taken will be logged. Max of 50.
            example:
            - case-id-1
            - case-id-2
            items:
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
          comment:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
          endpoint_ids:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
          parameters:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        required:
        - endpoint_ids
      - type: object
        properties:
          parameters:
            type: object
            properties:
              path:
                description: The full file path to retrieve from the endpoint.
                type: string
            required:
            - path
        required:
        - parameters
    Security_Endpoint_Management_API_Parameters:
      description: Parameters object
      type: object
    Security_Endpoint_Management_API_MetadataListResponse:
      example:
        data:
        - host_status: healthy
          last_checkin: '2023-07-04T15:47:57.432Z'
          metadata:
            '@timestamp': '2023-07-04T15:47:57.432173535Z'
            agent:
              build:
                original: 'version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
              id: 285297c6-3bff-4b83-9a07-f3e749801123
              type: endpoint
              version: 7.16.0
            data_stream:
              dataset: endpoint.metadata
              namespace: default
              type: metrics
            ecs:
              version: 1.11.0
            elastic:
              agent:
                id: 285297c6-3bff-4b83-9a07-f3e749801123
            Endpoint:
              capabilities:
              - isolation
              configuration:
                isolation: false
              policy:
                applied:
                  endpoint_policy_version: '2'
                  id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                  name: test
                  status: success
                  version: '3'
              state:
                isolation: false
              status: enrolled
            event:
              action: endpoint_metadata
              agent_id_status: verified
              category:
              - host
              created: '2023-07-04T15:47:57.432173535Z'
              dataset: endpoint.metadata
              id: MNtSXK/SkhEBnmgt++++++7S
              ingested: '2023-07-04T15:47:58Z'
              kind: metric
              module: endpoint
              sequence: 400
              type:
              - info
            host:
              architecture: x86_64
              hostname: david-Xubuntu
              id: 0cfead88e2024bd8a27476352b5ab264
              ip:
              - 127.0.0.1
              - ::1
              - 10.0.2.15
              - fe80::2ac7:8e15:b957:2fa1
              mac:
              - 08:00:27:e6:78:8b
              name: david-Xubuntu
              os:
                Ext:
                  variant: Ubuntu
                family: ubuntu
                full: Ubuntu 20.04.2
                kernel: '5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021'
                name: Linux
                platform: ubuntu
                type: linux
                version: 20.04.2
            message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 0
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
        - host_status: healthy
          last_checkin: '2023-07-04T15:44:31.491Z'
          metadata:
            '@timestamp': '2023-07-04T15:44:31.4917849Z'
            agent:
              build:
                original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
              id: abb8a826-6812-448c-a571-6d8269b51449
              type: endpoint
              version: 7.16.0
            data_stream:
              dataset: endpoint.metadata
              namespace: default
              type: metrics
            ecs:
              version: 1.11.0
            elastic:
              agent:
                id: abb8a826-6812-448c-a571-6d8269b51449
            Endpoint:
              capabilities:
              - isolation
              configuration:
                isolation: false
              policy:
                applied:
                  endpoint_policy_version: '2'
                  id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                  name: test
                  status: success
                  version: '3'
              state:
                isolation: false
              status: enrolled
            event:
              action: endpoint_metadata
              agent_id_status: verified
              category:
              - host
              created: '2023-07-04T15:44:31.4917849Z'
              dataset: endpoint.metadata
              id: MNtRc++KoKHXXwlj+++++/N9
              ingested: '2023-07-04T15:44:33Z'
              kind: metric
              module: endpoint
              sequence: 5159
              type:
              - info
            host:
              architecture: x86_64
              hostname: WinDev2104Eval
              id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
              ip:
              - 10.0.2.15
              - fe80::21a6:63d3:d70e:e3ad
              - 127.0.0.1
              - ::1
              mac:
              - 08:00:27:b1:1d:5a
              name: WinDev2104Eval
              os:
                Ext:
                  variant: Windows 10 Enterprise Evaluation
                family: windows
                full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
                kernel: 20H2 (10.0.19042.906)
                name: Windows
                platform: windows
                type: windows
                version: 20H2 (10.0.19042.906)
            message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 0
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
        page: 0
        pageSize: 10
        sortDirection: desc
        sortField: enrolled_at
        total: 2
      type: object
      properties: {}
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"