> ## Documentation Index
> Fetch the complete documentation index at: https://tracecat-codex-docs-secrets-oauth-discoverability.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Elastic Security

> Reference for the Tracecat Elastic Security integration: registered actions, required secrets, expected inputs, and example workflow usage.

## (Deprecated) List detection alerts

Action ID: `tools.elastic_security.list_detection_signals`

Deprecated compatibility action. Use `tools.elastic_security.search_detection_alerts` for API-native alert searches.

Reference: [https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts](https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-searchalerts)

**Deprecated:** Use `tools.elastic_security.search_detection_alerts` for API-native alert searches.

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time for the query (exclusive).
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time for the query (inclusive).
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana endpoint URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of alerts to return.

  Default: `100`.
</ParamField>

<ParamField path="query" type="string | object | null">
  Elastic JSON query DSL. If specified, overrides `start_time` and `end_time`.

  Default: `null`.
</ParamField>

<ParamField path="source_fields" type="array[string] | object | null">
  Source field filter applied to each alert. Pass a list of dotted field
  names to include only those fields, or a dict of `includes` / `excludes`
  for fine-grained control. Maps directly to the Kibana `_source` request
  body parameter. When `null` (default), every field is returned.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Assign detection alert users

Action ID: `tools.elastic_security.assign_detection_alert_users`

Assign or unassign users on Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertassignees](https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertassignees)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Bulk action detection rules

Action ID: `tools.elastic_security.bulk_action_detection_rules`

Apply a bulk action to Elastic Security detection rules.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-performrulesbulkaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-performrulesbulkaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Cancel response action

Action ID: `tools.elastic_security.cancel_response_action`

Cancel an Elastic Endpoint response action.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-cancelaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-cancelaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create detection rule

Action ID: `tools.elastic_security.create_detection_rule`

Create an Elastic Security detection rule.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-createrule](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createrule)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create endpoint script

Action ID: `tools.elastic_security.create_endpoint_script`

Create a script in the Elastic Endpoint response script library.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarycreatescript](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarycreatescript)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base64_content" type="string" required>
  Base64-encoded script file.
</ParamField>

<ParamField path="filename" type="string" required>
  Script filename sent to Elastic.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native multipart script metadata fields.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="content_type" type="string">
  MIME type of the script file.

  Default: `"application/octet-stream"`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create exception list

Action ID: `tools.elastic_security.create_exception_list`

Create an Elastic Security exception list.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlist](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlist)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters, including API identifiers where required.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Create exception list item

Action ID: `tools.elastic_security.create_exception_list_item`

Create an item in an Elastic Security exception list.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlistitem](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createexceptionlistitem)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters, including API identifiers where required.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Delete exception list item

Action ID: `tools.elastic_security.delete_exception_list_item`

Delete an Elastic Security exception list item.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-deleteexceptionlistitem](https://www.elastic.co/docs/api/doc/kibana/operation/operation-deleteexceptionlistitem)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters, including API identifiers where required.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Download response file

Action ID: `tools.elastic_security.download_response_file`

Download a response-action file as base64.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfiledownload](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfiledownload)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="action_id" type="string" required>
  Response action ID.
</ParamField>

<ParamField path="file_id" type="string" required>
  Response file ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Export detection rules

Action ID: `tools.elastic_security.export_detection_rules`

Export Elastic Security detection rules as NDJSON text.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportrules](https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportrules)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Generate endpoint memory dump

Action ID: `tools.elastic_security.generate_endpoint_memory_dump`

Generate a memory dump on an Elastic Endpoint.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgeneratememorydump](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgeneratememorydump)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get endpoint

Action ID: `tools.elastic_security.get_endpoint`

Get Elastic Endpoint metadata by endpoint ID.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadata](https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadata)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="endpoint_id" type="string" required>
  Endpoint ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get endpoint file

Action ID: `tools.elastic_security.get_endpoint_file`

Request a file from one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetfileaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetfileaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get endpoint processes

Action ID: `tools.elastic_security.get_endpoint_processes`

Get running processes from one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetprocessesaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetprocessesaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get response action

Action ID: `tools.elastic_security.get_response_action`

Get an Elastic Endpoint response action by ID.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionsdetails](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionsdetails)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="action_id" type="string" required>
  Response action ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get response file info

Action ID: `tools.elastic_security.get_response_file_info`

Get information about a file returned by an Endpoint response action.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfileinfo](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointfileinfo)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="action_id" type="string" required>
  Response action ID.
</ParamField>

<ParamField path="file_id" type="string" required>
  Response file ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Import detection rules

Action ID: `tools.elastic_security.import_detection_rules`

Import Elastic Security detection rules from an NDJSON file.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-importrules](https://www.elastic.co/docs/api/doc/kibana/operation/operation-importrules)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base64_content" type="string" required>
  Base64-encoded NDJSON rules file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="filename" type="string">
  Filename sent to Elastic.

  Default: `"rules.ndjson"`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native import query parameters such as overwrite.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Isolate endpoint

Action ID: `tools.elastic_security.isolate_endpoint`

Isolate one or more Elastic Endpoints from the network.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointisolateaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointisolateaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List detection rules

Action ID: `tools.elastic_security.list_detection_rules`

List Elastic Security detection rules.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-findrules](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findrules)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List endpoint scripts

Action ID: `tools.elastic_security.list_endpoint_scripts`

List scripts in the Elastic Endpoint response script library.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarylistscripts](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscriptlibrarylistscripts)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List endpoints

Action ID: `tools.elastic_security.list_endpoints`

List Elastic Endpoint metadata.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadatalist](https://www.elastic.co/docs/api/doc/kibana/operation/operation-getendpointmetadatalist)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List exception list items

Action ID: `tools.elastic_security.list_exception_list_items`

List exception conditions within exception-list containers.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlistitems](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlistitems)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters, including API identifiers where required.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List exception lists

Action ID: `tools.elastic_security.list_exception_lists`

List exception-list containers and metadata. This does not return their exception items.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlists](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findexceptionlists)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters, including API identifiers where required.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List response actions

Action ID: `tools.elastic_security.list_response_actions`

List Elastic Endpoint response actions.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionslist](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointgetactionslist)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Patch detection rule

Action ID: `tools.elastic_security.patch_detection_rule`

Partially update an Elastic Security detection rule.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-patchrule](https://www.elastic.co/docs/api/doc/kibana/operation/operation-patchrule)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Preview detection rule

Action ID: `tools.elastic_security.preview_detection_rule`

Preview alerts generated by an Elastic Security detection rule.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-rulepreview](https://www.elastic.co/docs/api/doc/kibana/operation/operation-rulepreview)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Release endpoint

Action ID: `tools.elastic_security.release_endpoint`

Release one or more isolated Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointunisolateaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointunisolateaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run endpoint command

Action ID: `tools.elastic_security.run_endpoint_command`

Run a command on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointexecuteaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointexecuteaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run endpoint script

Action ID: `tools.elastic_security.run_endpoint_script`

Run a response script on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-runscriptaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-runscriptaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run Osquery live query

Action ID: `tools.elastic_security.run_osquery_live_query`

Run an API-native Osquery live query against Elastic Agents for host investigation.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-osquerycreatelivequery](https://www.elastic.co/docs/api/doc/kibana/operation/operation-osquerycreatelivequery)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native live query JSON request body, including targets and query or pack details.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Scan endpoint path

Action ID: `tools.elastic_security.scan_endpoint_path`

Scan a file or directory on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscanaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointscanaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search attack discoveries

Action ID: `tools.elastic_security.search_attack_discoveries`

Search existing Elastic Attack Discovery results using native filters and pagination.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-attackdiscoveryfind](https://www.elastic.co/docs/api/doc/kibana/operation/operation-attackdiscoveryfind)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native search, filter, pagination, and sorting parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search detection alerts

Action ID: `tools.elastic_security.search_detection_alerts`

Find or aggregate Elastic Security detection alerts using the API-native search body.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-searchalerts](https://www.elastic.co/docs/api/doc/kibana/operation/operation-searchalerts)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search entities

Action ID: `tools.elastic_security.search_entities`

Search Elastic Entity Store records for investigation context, including entity risk and asset data.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-security-entity-store-entities](https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-security-entity-store-entities)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native entity filters, fields, sorting, and pagination parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Set detection alert status

Action ID: `tools.elastic_security.set_detection_alert_status`

Set the status of Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertsstatus](https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalertsstatus)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Suspend endpoint process

Action ID: `tools.elastic_security.suspend_endpoint_process`

Suspend a process on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointsuspendprocessaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointsuspendprocessaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Terminate endpoint process

Action ID: `tools.elastic_security.terminate_endpoint_process`

Terminate a process on one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointkillprocessaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointkillprocessaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Update detection alert tags

Action ID: `tools.elastic_security.update_detection_alert_tags`

Add or remove tags on Elastic Security detection alerts.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalerttags](https://www.elastic.co/docs/api/doc/kibana/operation/operation-setalerttags)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Upload endpoint file

Action ID: `tools.elastic_security.upload_endpoint_file`

Upload a file to one or more Elastic Endpoints.

Reference: [https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointuploadaction](https://www.elastic.co/docs/api/doc/kibana/operation/operation-endpointuploadaction)

### Secrets

Required secrets:

* `elastic_security`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base64_content" type="string" required>
  Base64-encoded file content.
</ParamField>

<ParamField path="filename" type="string" required>
  Filename sent to Elastic.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native multipart fields, such as endpoint\_ids and parameters.
</ParamField>

<ParamField path="base_url" type="string | null">
  Kibana base URL (e.g. [https://localhost:5601](https://localhost:5601)).

  Default: `null`.
</ParamField>

<ParamField path="content_type" type="string">
  MIME type of the uploaded file.

  Default: `"application/octet-stream"`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Kibana query parameters.

  Default: `null`.
</ParamField>

<ParamField path="space_id" type="string | null">
  Optional Kibana space ID. Omit for the default space.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>