[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-kibana-connectors":3,"mdc--z0dr5j-key":37,"related-repo-elastic-kibana-connectors":4037,"related-org-elastic-kibana-connectors":4131},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":35,"mdContent":36},"kibana-connectors","configure Kibana connectors for third-party services","Create and manage Kibana connectors for Slack, PagerDuty, Jira, webhooks, and more via REST API or Terraform. Use when configuring third-party integrations or managing connectors as code.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20,23],{"name":13,"slug":14,"type":15},"Jira","jira","tag",{"name":17,"slug":18,"type":15},"Integrations","integrations",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Kibana","kibana",{"name":24,"slug":25,"type":15},"Slack","slack",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:51.2598",null,41,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":34},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fkibana\u002Fkibana-connectors","---\nname: kibana-connectors\ndescription: >\n  Create and manage Kibana connectors for Slack, PagerDuty, Jira, webhooks, and more\n  via REST API or Terraform. Use when configuring third-party integrations or managing\n  connectors as code.\nmetadata:\n  author: elastic\n  version: 0.1.1\n---\n\n# Kibana Connectors\n\n## Core Concepts\n\nConnectors store connection information for Elastic services and third-party systems. Alerting rules use connectors to\nroute **actions** (notifications) when rule conditions are met. Connectors are managed per **Kibana Space** and can be\nshared across all rules within that space.\n\n### Connector Categories\n\n| Category                    | Connector Types                                                                                                                                                      |\n| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| **LLM Providers**           | OpenAI, Google Gemini, Amazon Bedrock, Elastic Managed LLMs, AI Connector, MCP (Preview, 9.3+)                                                                       |\n| **Incident Management**     | PagerDuty, Opsgenie, ServiceNow (ITSM, SecOps, ITOM), Jira, Jira Service Management (9.2+), IBM Resilient, Swimlane, Torq, Tines, D3 Security, XSOAR (9.1+), TheHive |\n| **Endpoint Security**       | CrowdStrike, SentinelOne, Microsoft Defender for Endpoint                                                                                                            |\n| **Messaging**               | Slack (API \u002F Webhook), Microsoft Teams, Email                                                                                                                        |\n| **Logging & Observability** | Server log, Index, Observability AI Assistant                                                                                                                        |\n| **Webhook**                 | Webhook, Webhook - Case Management, xMatters                                                                                                                         |\n| **Elastic**                 | Cases                                                                                                                                                                |\n\n## Authentication\n\nAll connector API calls require API key auth or Basic auth. Every mutating request must include the `kbn-xsrf` header.\n\n```http\nkbn-xsrf: true\n```\n\n## Required Privileges\n\nAccess to connectors is granted based on your privileges to alerting-enabled features. You need `all` privileges for\nActions and Connectors in Stack Management.\n\n## API Reference\n\nBase path: `\u003Ckibana_url>\u002Fapi\u002Factions` (or `\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Factions` for non-default spaces).\n\n| Operation           | Method | Endpoint                               |\n| ------------------- | ------ | -------------------------------------- |\n| Create connector    | POST   | `\u002Fapi\u002Factions\u002Fconnector\u002F{id}`          |\n| Update connector    | PUT    | `\u002Fapi\u002Factions\u002Fconnector\u002F{id}`          |\n| Get connector       | GET    | `\u002Fapi\u002Factions\u002Fconnector\u002F{id}`          |\n| Delete connector    | DELETE | `\u002Fapi\u002Factions\u002Fconnector\u002F{id}`          |\n| Get all connectors  | GET    | `\u002Fapi\u002Factions\u002Fconnectors`              |\n| Get connector types | GET    | `\u002Fapi\u002Factions\u002Fconnector_types`         |\n| Run connector       | POST   | `\u002Fapi\u002Factions\u002Fconnector\u002F{id}\u002F_execute` |\n\n## Creating a Connector\n\n### Required Fields\n\n| Field               | Type   | Description                                                                      |\n| ------------------- | ------ | -------------------------------------------------------------------------------- |\n| `name`              | string | Display name for the connector                                                   |\n| `connector_type_id` | string | The connector type (e.g., `.slack`, `.email`, `.webhook`, `.pagerduty`, `.jira`) |\n| `config`            | object | Type-specific configuration (non-secret settings)                                |\n| `secrets`           | object | Type-specific secrets (API keys, passwords, tokens)                              |\n\n### Example: Create a Slack Connector (Webhook)\n\n```bash\ncurl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n  -d '{\n    \"name\": \"Production Slack Alerts\",\n    \"connector_type_id\": \".slack\",\n    \"config\": {},\n    \"secrets\": {\n      \"webhookUrl\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n    }\n  }'\n```\n\nAll connector types share the same request structure — only `connector_type_id`, `config`, and `secrets` differ. See the\n[Common Connector Type IDs](#common-connector-type-ids) table for available types and their required fields.\n\n### Example: Create a PagerDuty Connector\n\n```bash\ncurl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-pagerduty\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n  -d '{\n    \"name\": \"PagerDuty Incidents\",\n    \"connector_type_id\": \".pagerduty\",\n    \"config\": {\n      \"apiUrl\": \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\"\n    },\n    \"secrets\": {\n      \"routingKey\": \"your-pagerduty-integration-key\"\n    }\n  }'\n```\n\n## Updating a Connector\n\n`PUT \u002Fapi\u002Factions\u002Fconnector\u002F{id}` replaces the full configuration. `connector_type_id` is immutable — delete and\nrecreate to change it.\n\n## Listing and Discovering Connectors\n\n```bash\n# Get all connectors in the current space\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnectors\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n\n# Get available connector types\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector_types\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n\n# Filter connector types by feature (e.g., only those supporting alerting)\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector_types?feature_id=alerting\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n```\n\nThe `GET \u002Fapi\u002Factions\u002Fconnectors` response includes `referenced_by_count` showing how many rules use each connector.\nAlways check this before deleting.\n\n## Running a Connector (Test)\n\nExecute a connector action directly, useful for testing connectivity.\n\n```bash\ncurl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\u002F_execute\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n  -d '{\n    \"params\": {\n      \"message\": \"Test alert from API\"\n    }\n  }'\n```\n\n## Deleting a Connector\n\n```bash\ncurl -X DELETE \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n```\n\n**Warning:** Deleting a connector that is referenced by rules will cause those rule actions to fail silently. Check\n`referenced_by_count` first.\n\n## Terraform Provider\n\nUse the `elasticstack` provider resource `elasticstack_kibana_action_connector`.\n\n```hcl\nterraform {\n  required_providers {\n    elasticstack = {\n      source  = \"elastic\u002Felasticstack\"\n    }\n  }\n}\n\nprovider \"elasticstack\" {\n  kibana {\n    endpoints = [\"https:\u002F\u002Fmy-kibana:5601\"]\n    api_key   = var.kibana_api_key\n  }\n}\n\nresource \"elasticstack_kibana_action_connector\" \"slack\" {\n  name              = \"Production Slack Alerts\"\n  connector_type_id = \".slack\"\n\n  config = jsonencode({})\n\n  secrets = jsonencode({\n    webhookUrl = \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n  })\n}\n\nresource \"elasticstack_kibana_action_connector\" \"index\" {\n  name              = \"Alert Index Writer\"\n  connector_type_id = \".index\"\n\n  config = jsonencode({\n    index              = \"alert-history\"\n    executionTimeField = \"@timestamp\"\n  })\n\n  secrets = jsonencode({})\n}\n```\n\n**Key Terraform notes:**\n\n- `config` and `secrets` must be JSON-encoded strings via `jsonencode()`\n- Secrets are stored in Terraform state; use a remote backend with encryption and restrict state file access\n- Import existing connectors:\n  `terraform import elasticstack_kibana_action_connector.my_connector \u003Cspace_id>\u002F\u003Cconnector_id>` (use `default` for the\n  default space)\n- After import, secrets are not populated in state; you must supply them in config\n\n## Preconfigured Connectors (On-Prem)\n\nFor self-managed Kibana, connectors can be preconfigured in `kibana.yml` so they are available at startup without manual\ncreation:\n\n```yaml\nxpack.actions.preconfigured:\n  my-slack-connector:\n    name: \"Production Slack\"\n    actionTypeId: .slack\n    secrets:\n      webhookUrl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n  my-webhook:\n    name: \"Custom Webhook\"\n    actionTypeId: .webhook\n    config:\n      url: \"https:\u002F\u002Fapi.example.com\u002Falerts\"\n      method: post\n      hasAuth: true\n    secrets:\n      user: \"alert-user\"\n      password: \"secret-password\"\n```\n\nPreconfigured connectors cannot be edited or deleted via the API or UI. They show `is_preconfigured: true` and omit\n`config` and `is_missing_secrets` from API responses.\n\n## Networking Configuration\n\nCustomize connector networking (proxies, TLS, certificates) via `kibana.yml`:\n\n```yaml\n# Global proxy for all connectors\nxpack.actions.proxyUrl: \"https:\u002F\u002Fproxy.example.com:8443\"\n\n# Per-host TLS settings\nxpack.actions.customHostSettings:\n  - url: \"https:\u002F\u002Fapi.example.com\"\n    ssl:\n      verificationMode: full\n      certificateAuthoritiesFiles: [\"\u002Fpath\u002Fto\u002Fca.pem\"]\n```\n\n## Connectors in Kibana Workflows\n\nConnectors serve as the integration layer across multiple Kibana workflows, not just alerting notifications:\n\n| Workflow                  | Connector Types                       | Key Pattern                                                                    |\n| ------------------------- | ------------------------------------- | ------------------------------------------------------------------------------ |\n| **ITSM ticketing**        | ServiceNow, Jira, IBM Resilient       | Create ticket on active, close on `Recovered`                                  |\n| **On-call escalation**    | PagerDuty, Opsgenie                   | `trigger` on active, `resolve` on `Recovered`; always set a deduplication key  |\n| **Case management**       | Cases (system action)                 | UI-only; groups alerts into investigation Cases; can auto-push to ITSM         |\n| **Messaging \u002F awareness** | Slack, Teams, Email                   | `onActionGroupChange` for incident channels; summaries for monitoring channels |\n| **Audit logging**         | Index                                 | `onActiveAlert` to write full alert time-series to Elasticsearch               |\n| **AI workflows**          | OpenAI, Bedrock, Gemini, AI Connector | Powers Elastic AI Assistant and Attack Discovery; system-managed               |\n| **Custom integrations**   | Webhook                               | Generic HTTP outbound with Mustache-templated JSON body                        |\n\nFor detailed patterns, examples, and decision guidance for each workflow, see [workflows.md](references\u002Fworkflows.md).\n\n## Best Practices\n\n1. **Use preconfigured connectors for production on-prem.** They eliminate secret sprawl, survive Saved Object imports,\n   and cannot be accidentally deleted. Reserve API-created connectors for dynamic or user-managed scenarios.\n\n2. **Test connectors before attaching to rules.** Use the `_execute` endpoint to verify connectivity. A misconfigured\n   connector causes silent action failures that only appear in the rule's execution history.\n\n3. **Check `referenced_by_count` before deleting.** Deleting a connector used by active rules causes those actions to\n   fail. List connectors and verify zero references, or reassign rules to a new connector first.\n\n4. **Use the Email domain allowlist.** The `xpack.actions.email.domain_allowlist` setting restricts which email domains\n   connectors can send to. If you update this list, existing email connectors with recipients outside the new list will\n   start failing.\n\n5. **Secure secrets in Terraform.** Connector secrets (API keys, passwords, webhook URLs) are stored in Terraform state.\n   Use encrypted remote backends (S3+KMS, Azure Blob+encryption, GCS+CMEK) and restrict access to state files. Use\n   `sensitive = true` on variables.\n\n6. **One connector per service, not per rule.** Create a single Slack connector and reference it from multiple rules.\n   This centralizes secret rotation and reduces duplication.\n\n7. **Use Spaces for multi-tenant isolation.** Connectors are scoped to a Kibana Space. Create separate spaces for\n   different teams or environments and configure connectors per space.\n\n8. **Monitor connector health.** Failed connector executions are logged in the event log index (`.kibana-event-log-*`).\n   Connector failures report as successful to Task Manager but fail silently for alert delivery. Check the\n   [Event Log Index](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts\u002Fevent-log-index) for true failure\n   rates.\n\n9. **Always configure a recovery action alongside the active action.** Connectors for ITSM and on-call tools\n   (ServiceNow, Jira, PagerDuty, Opsgenie) support a close\u002Fresolve operation. Without a recovery action, incidents\n   remain open forever.\n\n10. **Use deduplication keys for on-call connectors.** Set `dedupKey` (PagerDuty) or `alias` (Opsgenie) to\n    `{{rule.id}}-{{alert.id}}` to ensure the resolve event closes exactly the right incident. Without this, a new\n    incident is created every time the alert re-fires.\n\n11. **Prefer the Cases connector for investigation workflows.** When an alert requires investigation with comments,\n    attachments, and assignees, use Cases rather than a direct Jira\u002FServiceNow connector. Cases gives you a native\n    investigation UI and can still push to ITSM via the Case's external connection.\n\n12. **Use the Index connector for durable audit trails.** The Index connector writes to Elasticsearch, making alert\n    history searchable and dashboardable. Pair it with an ILM policy on the target index to control retention.\n\n13. **Restrict connector access via Action settings.** Use `xpack.actions.enabledActionTypes` to allowlist only the\n    connector types your organization needs, and `xpack.actions.allowedHosts` to restrict outbound connections to known\n    endpoints.\n\n## Common Pitfalls\n\n1. **Missing `kbn-xsrf` header.** All POST, PUT, DELETE requests require `kbn-xsrf: true`. Omitting it returns a 400\n   error.\n\n2. **Wrong `connector_type_id`.** Use the exact string including the leading dot (e.g., `.slack`, not `slack`). Discover\n   valid types via `GET \u002Fapi\u002Factions\u002Fconnector_types`.\n\n3. **Empty `secrets` object required.** Even for connectors without secrets (e.g., `.index`, `.server-log`), you must\n   provide `\"secrets\": {}` in the create request.\n\n4. **Connector type is immutable.** You cannot change the `connector_type_id` after creation. Delete and recreate\n   instead.\n\n5. **Secrets lost on export\u002Fimport.** Exporting connectors via Saved Objects strips secrets. After import, connectors\n   show `is_missing_secrets: true` and a \"Fix\" button appears in the UI. You must re-enter secrets manually or via API.\n\n6. **Preconfigured connectors cannot be modified via API.** Attempting to update or delete a preconfigured connector\n   returns 400. Manage them exclusively in `kibana.yml`.\n\n7. **Rate limits from third-party services.** Connectors that send high volumes of notifications (e.g., one per alert\n   every minute) can hit Slack, PagerDuty, or email provider rate limits. Use alert summaries and action frequency\n   controls on the rule side to reduce volume.\n\n8. **Connector networking failures.** Kibana must be able to reach the connector's target URL. Verify firewall rules,\n   proxy settings, and DNS resolution. Use `xpack.actions.customHostSettings` for TLS issues.\n\n9. **License requirements.** Some connector types require a Gold, Platinum, or Enterprise license. Check the\n   `minimum_license_required` field from `GET \u002Fapi\u002Factions\u002Fconnector_types`. A connector that is\n   `enabled_in_config: true` but `enabled_in_license: false` cannot be used.\n\n10. **Terraform import does not restore secrets.** When importing an existing connector into Terraform, the secrets are\n    not read back from Kibana. You must provide them in your Terraform configuration, or the next `terraform apply` will\n    overwrite them with empty values.\n\n## Common Connector Type IDs\n\n| Type ID                        | Name                            | License    |\n| ------------------------------ | ------------------------------- | ---------- |\n| `.email`                       | Email                           | Gold       |\n| `.slack`                       | Slack (Webhook)                 | Gold       |\n| `.slack_api`                   | Slack (API)                     | Gold       |\n| `.pagerduty`                   | PagerDuty                       | Gold       |\n| `.jira`                        | Jira                            | Gold       |\n| `.servicenow`                  | ServiceNow ITSM                 | Platinum   |\n| `.servicenow-sir`              | ServiceNow SecOps               | Platinum   |\n| `.servicenow-itom`             | ServiceNow ITOM                 | Platinum   |\n| `.webhook`                     | Webhook                         | Gold       |\n| `.index`                       | Index                           | Basic      |\n| `.server-log`                  | Server log                      | Basic      |\n| `.opsgenie`                    | Opsgenie                        | Gold       |\n| `.teams`                       | Microsoft Teams                 | Gold       |\n| `.gen-ai`                      | OpenAI                          | Enterprise |\n| `.bedrock`                     | Amazon Bedrock                  | Enterprise |\n| `.gemini`                      | Google Gemini                   | Enterprise |\n| `.cases`                       | Cases                           | Platinum   |\n| `.crowdstrike`                 | CrowdStrike                     | Enterprise |\n| `.sentinelone`                 | SentinelOne                     | Enterprise |\n| `.microsoft_defender_endpoint` | Microsoft Defender for Endpoint | Enterprise |\n| `.thehive`                     | TheHive                         | Gold       |\n\n> **Note:** Use `GET \u002Fapi\u002Factions\u002Fconnector_types` to discover all available types on your deployment along with their\n> exact `minimum_license_required` values. Connector types for XSOAR, Jira Service Management, and MCP are available but\n> may not appear in older API spec versions.\n\n## Examples\n\n**Create a Slack connector:** \"Set up Slack notifications for our alerts.\" `POST \u002Fapi\u002Factions\u002Fconnector` with\n`connector_type_id: \".slack\"` and `secrets.webhookUrl`. Use the returned connector `id` in rule actions.\n\n**Test a connector before attaching to rules:** \"Verify the PagerDuty connector works.\"\n`POST \u002Fapi\u002Factions\u002Fconnector\u002F{id}\u002F_execute` with a minimal params object to confirm connectivity before adding to any\nrule.\n\n**Audit connector usage before deletion:** \"Remove the old email connector.\" `GET \u002Fapi\u002Factions\u002Fconnectors`, inspect\n`referenced_by_count` — if non-zero, reassign the referencing rules first, then `DELETE \u002Fapi\u002Factions\u002Fconnector\u002F{id}`.\n\n## Guidelines\n\n- Include `kbn-xsrf: true` on every POST, PUT, and DELETE; omitting it returns 400.\n- `connector_type_id` is immutable — delete and recreate to change connector type.\n- Always pass `\"secrets\": {}` even for connectors with no secrets (e.g., `.index`, `.server-log`).\n- Check `referenced_by_count` before deleting; a deleted connector silently breaks all referencing rule actions.\n- Connectors are space-scoped; prefix paths with `\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Factions\u002F` for non-default Kibana Spaces.\n- Secrets are write-only: not returned by GET and stripped on Saved Object export\u002Fimport; always re-supply after import.\n- Test every new connector with `_execute` before attaching to rules; connector failures in production are silent.\n\n## Additional Resources\n\n- [Kibana Connectors API Reference](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-connectors)\n- [Connectors Overview](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fkibana\u002Fconnectors-kibana)\n- [Preconfigured Connectors](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fkibana\u002Fconnectors-kibana\u002Fpre-configured-connectors)\n- [Alerting Settings (Action Config)](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fkibana\u002Fconfiguration-reference\u002Falerting-settings#action-settings)\n- [Terraform: elasticstack_kibana_action_connector](https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fresources\u002Fkibana_action_connector)\n- [Terraform: Managing Kibana Rule and Connector Resources](https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fguides\u002Felasticstack-kibana-rule)\n",{"data":38,"body":41},{"name":4,"description":6,"metadata":39},{"author":8,"version":40},"0.1.1",{"type":42,"children":43},"root",[44,52,59,80,87,226,232,246,267,273,286,292,313,488,494,500,650,656,870,904,910,1108,1114,1132,1138,1341,1362,1368,1373,1530,1536,1617,1634,1640,1661,1976,1984,2043,2049,2062,2362,2389,2395,2406,2567,2573,2578,2789,2801,2807,3030,3036,3276,3281,3742,3769,3775,3816,3834,3865,3871,3962,3968,4031],{"type":45,"tag":46,"props":47,"children":48},"element","h1",{"id":4},[49],{"type":50,"value":51},"text","Kibana Connectors",{"type":45,"tag":53,"props":54,"children":56},"h2",{"id":55},"core-concepts",[57],{"type":50,"value":58},"Core Concepts",{"type":45,"tag":60,"props":61,"children":62},"p",{},[63,65,71,73,78],{"type":50,"value":64},"Connectors store connection information for Elastic services and third-party systems. Alerting rules use connectors to\nroute ",{"type":45,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":50,"value":70},"actions",{"type":50,"value":72}," (notifications) when rule conditions are met. Connectors are managed per ",{"type":45,"tag":66,"props":74,"children":75},{},[76],{"type":50,"value":77},"Kibana Space",{"type":50,"value":79}," and can be\nshared across all rules within that space.",{"type":45,"tag":81,"props":82,"children":84},"h3",{"id":83},"connector-categories",[85],{"type":50,"value":86},"Connector Categories",{"type":45,"tag":88,"props":89,"children":90},"table",{},[91,110],{"type":45,"tag":92,"props":93,"children":94},"thead",{},[95],{"type":45,"tag":96,"props":97,"children":98},"tr",{},[99,105],{"type":45,"tag":100,"props":101,"children":102},"th",{},[103],{"type":50,"value":104},"Category",{"type":45,"tag":100,"props":106,"children":107},{},[108],{"type":50,"value":109},"Connector Types",{"type":45,"tag":111,"props":112,"children":113},"tbody",{},[114,131,147,163,179,195,211],{"type":45,"tag":96,"props":115,"children":116},{},[117,126],{"type":45,"tag":118,"props":119,"children":120},"td",{},[121],{"type":45,"tag":66,"props":122,"children":123},{},[124],{"type":50,"value":125},"LLM Providers",{"type":45,"tag":118,"props":127,"children":128},{},[129],{"type":50,"value":130},"OpenAI, Google Gemini, Amazon Bedrock, Elastic Managed LLMs, AI Connector, MCP (Preview, 9.3+)",{"type":45,"tag":96,"props":132,"children":133},{},[134,142],{"type":45,"tag":118,"props":135,"children":136},{},[137],{"type":45,"tag":66,"props":138,"children":139},{},[140],{"type":50,"value":141},"Incident Management",{"type":45,"tag":118,"props":143,"children":144},{},[145],{"type":50,"value":146},"PagerDuty, Opsgenie, ServiceNow (ITSM, SecOps, ITOM), Jira, Jira Service Management (9.2+), IBM Resilient, Swimlane, Torq, Tines, D3 Security, XSOAR (9.1+), TheHive",{"type":45,"tag":96,"props":148,"children":149},{},[150,158],{"type":45,"tag":118,"props":151,"children":152},{},[153],{"type":45,"tag":66,"props":154,"children":155},{},[156],{"type":50,"value":157},"Endpoint Security",{"type":45,"tag":118,"props":159,"children":160},{},[161],{"type":50,"value":162},"CrowdStrike, SentinelOne, Microsoft Defender for Endpoint",{"type":45,"tag":96,"props":164,"children":165},{},[166,174],{"type":45,"tag":118,"props":167,"children":168},{},[169],{"type":45,"tag":66,"props":170,"children":171},{},[172],{"type":50,"value":173},"Messaging",{"type":45,"tag":118,"props":175,"children":176},{},[177],{"type":50,"value":178},"Slack (API \u002F Webhook), Microsoft Teams, Email",{"type":45,"tag":96,"props":180,"children":181},{},[182,190],{"type":45,"tag":118,"props":183,"children":184},{},[185],{"type":45,"tag":66,"props":186,"children":187},{},[188],{"type":50,"value":189},"Logging & Observability",{"type":45,"tag":118,"props":191,"children":192},{},[193],{"type":50,"value":194},"Server log, Index, Observability AI Assistant",{"type":45,"tag":96,"props":196,"children":197},{},[198,206],{"type":45,"tag":118,"props":199,"children":200},{},[201],{"type":45,"tag":66,"props":202,"children":203},{},[204],{"type":50,"value":205},"Webhook",{"type":45,"tag":118,"props":207,"children":208},{},[209],{"type":50,"value":210},"Webhook, Webhook - Case Management, xMatters",{"type":45,"tag":96,"props":212,"children":213},{},[214,221],{"type":45,"tag":118,"props":215,"children":216},{},[217],{"type":45,"tag":66,"props":218,"children":219},{},[220],{"type":50,"value":9},{"type":45,"tag":118,"props":222,"children":223},{},[224],{"type":50,"value":225},"Cases",{"type":45,"tag":53,"props":227,"children":229},{"id":228},"authentication",[230],{"type":50,"value":231},"Authentication",{"type":45,"tag":60,"props":233,"children":234},{},[235,237,244],{"type":50,"value":236},"All connector API calls require API key auth or Basic auth. Every mutating request must include the ",{"type":45,"tag":238,"props":239,"children":241},"code",{"className":240},[],[242],{"type":50,"value":243},"kbn-xsrf",{"type":50,"value":245}," header.",{"type":45,"tag":247,"props":248,"children":253},"pre",{"className":249,"code":250,"language":251,"meta":252,"style":252},"language-http shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kbn-xsrf: true\n","http","",[254],{"type":45,"tag":238,"props":255,"children":256},{"__ignoreMap":252},[257],{"type":45,"tag":258,"props":259,"children":262},"span",{"class":260,"line":261},"line",1,[263],{"type":45,"tag":258,"props":264,"children":265},{},[266],{"type":50,"value":250},{"type":45,"tag":53,"props":268,"children":270},{"id":269},"required-privileges",[271],{"type":50,"value":272},"Required Privileges",{"type":45,"tag":60,"props":274,"children":275},{},[276,278,284],{"type":50,"value":277},"Access to connectors is granted based on your privileges to alerting-enabled features. You need ",{"type":45,"tag":238,"props":279,"children":281},{"className":280},[],[282],{"type":50,"value":283},"all",{"type":50,"value":285}," privileges for\nActions and Connectors in Stack Management.",{"type":45,"tag":53,"props":287,"children":289},{"id":288},"api-reference",[290],{"type":50,"value":291},"API Reference",{"type":45,"tag":60,"props":293,"children":294},{},[295,297,303,305,311],{"type":50,"value":296},"Base path: ",{"type":45,"tag":238,"props":298,"children":300},{"className":299},[],[301],{"type":50,"value":302},"\u003Ckibana_url>\u002Fapi\u002Factions",{"type":50,"value":304}," (or ",{"type":45,"tag":238,"props":306,"children":308},{"className":307},[],[309],{"type":50,"value":310},"\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Factions",{"type":50,"value":312}," for non-default spaces).",{"type":45,"tag":88,"props":314,"children":315},{},[316,337],{"type":45,"tag":92,"props":317,"children":318},{},[319],{"type":45,"tag":96,"props":320,"children":321},{},[322,327,332],{"type":45,"tag":100,"props":323,"children":324},{},[325],{"type":50,"value":326},"Operation",{"type":45,"tag":100,"props":328,"children":329},{},[330],{"type":50,"value":331},"Method",{"type":45,"tag":100,"props":333,"children":334},{},[335],{"type":50,"value":336},"Endpoint",{"type":45,"tag":111,"props":338,"children":339},{},[340,362,383,404,425,446,467],{"type":45,"tag":96,"props":341,"children":342},{},[343,348,353],{"type":45,"tag":118,"props":344,"children":345},{},[346],{"type":50,"value":347},"Create connector",{"type":45,"tag":118,"props":349,"children":350},{},[351],{"type":50,"value":352},"POST",{"type":45,"tag":118,"props":354,"children":355},{},[356],{"type":45,"tag":238,"props":357,"children":359},{"className":358},[],[360],{"type":50,"value":361},"\u002Fapi\u002Factions\u002Fconnector\u002F{id}",{"type":45,"tag":96,"props":363,"children":364},{},[365,370,375],{"type":45,"tag":118,"props":366,"children":367},{},[368],{"type":50,"value":369},"Update connector",{"type":45,"tag":118,"props":371,"children":372},{},[373],{"type":50,"value":374},"PUT",{"type":45,"tag":118,"props":376,"children":377},{},[378],{"type":45,"tag":238,"props":379,"children":381},{"className":380},[],[382],{"type":50,"value":361},{"type":45,"tag":96,"props":384,"children":385},{},[386,391,396],{"type":45,"tag":118,"props":387,"children":388},{},[389],{"type":50,"value":390},"Get connector",{"type":45,"tag":118,"props":392,"children":393},{},[394],{"type":50,"value":395},"GET",{"type":45,"tag":118,"props":397,"children":398},{},[399],{"type":45,"tag":238,"props":400,"children":402},{"className":401},[],[403],{"type":50,"value":361},{"type":45,"tag":96,"props":405,"children":406},{},[407,412,417],{"type":45,"tag":118,"props":408,"children":409},{},[410],{"type":50,"value":411},"Delete connector",{"type":45,"tag":118,"props":413,"children":414},{},[415],{"type":50,"value":416},"DELETE",{"type":45,"tag":118,"props":418,"children":419},{},[420],{"type":45,"tag":238,"props":421,"children":423},{"className":422},[],[424],{"type":50,"value":361},{"type":45,"tag":96,"props":426,"children":427},{},[428,433,437],{"type":45,"tag":118,"props":429,"children":430},{},[431],{"type":50,"value":432},"Get all connectors",{"type":45,"tag":118,"props":434,"children":435},{},[436],{"type":50,"value":395},{"type":45,"tag":118,"props":438,"children":439},{},[440],{"type":45,"tag":238,"props":441,"children":443},{"className":442},[],[444],{"type":50,"value":445},"\u002Fapi\u002Factions\u002Fconnectors",{"type":45,"tag":96,"props":447,"children":448},{},[449,454,458],{"type":45,"tag":118,"props":450,"children":451},{},[452],{"type":50,"value":453},"Get connector types",{"type":45,"tag":118,"props":455,"children":456},{},[457],{"type":50,"value":395},{"type":45,"tag":118,"props":459,"children":460},{},[461],{"type":45,"tag":238,"props":462,"children":464},{"className":463},[],[465],{"type":50,"value":466},"\u002Fapi\u002Factions\u002Fconnector_types",{"type":45,"tag":96,"props":468,"children":469},{},[470,475,479],{"type":45,"tag":118,"props":471,"children":472},{},[473],{"type":50,"value":474},"Run connector",{"type":45,"tag":118,"props":476,"children":477},{},[478],{"type":50,"value":352},{"type":45,"tag":118,"props":480,"children":481},{},[482],{"type":45,"tag":238,"props":483,"children":485},{"className":484},[],[486],{"type":50,"value":487},"\u002Fapi\u002Factions\u002Fconnector\u002F{id}\u002F_execute",{"type":45,"tag":53,"props":489,"children":491},{"id":490},"creating-a-connector",[492],{"type":50,"value":493},"Creating a Connector",{"type":45,"tag":81,"props":495,"children":497},{"id":496},"required-fields",[498],{"type":50,"value":499},"Required Fields",{"type":45,"tag":88,"props":501,"children":502},{},[503,524],{"type":45,"tag":92,"props":504,"children":505},{},[506],{"type":45,"tag":96,"props":507,"children":508},{},[509,514,519],{"type":45,"tag":100,"props":510,"children":511},{},[512],{"type":50,"value":513},"Field",{"type":45,"tag":100,"props":515,"children":516},{},[517],{"type":50,"value":518},"Type",{"type":45,"tag":100,"props":520,"children":521},{},[522],{"type":50,"value":523},"Description",{"type":45,"tag":111,"props":525,"children":526},{},[527,549,607,629],{"type":45,"tag":96,"props":528,"children":529},{},[530,539,544],{"type":45,"tag":118,"props":531,"children":532},{},[533],{"type":45,"tag":238,"props":534,"children":536},{"className":535},[],[537],{"type":50,"value":538},"name",{"type":45,"tag":118,"props":540,"children":541},{},[542],{"type":50,"value":543},"string",{"type":45,"tag":118,"props":545,"children":546},{},[547],{"type":50,"value":548},"Display name for the connector",{"type":45,"tag":96,"props":550,"children":551},{},[552,561,565],{"type":45,"tag":118,"props":553,"children":554},{},[555],{"type":45,"tag":238,"props":556,"children":558},{"className":557},[],[559],{"type":50,"value":560},"connector_type_id",{"type":45,"tag":118,"props":562,"children":563},{},[564],{"type":50,"value":543},{"type":45,"tag":118,"props":566,"children":567},{},[568,570,576,578,584,585,591,592,598,599,605],{"type":50,"value":569},"The connector type (e.g., ",{"type":45,"tag":238,"props":571,"children":573},{"className":572},[],[574],{"type":50,"value":575},".slack",{"type":50,"value":577},", ",{"type":45,"tag":238,"props":579,"children":581},{"className":580},[],[582],{"type":50,"value":583},".email",{"type":50,"value":577},{"type":45,"tag":238,"props":586,"children":588},{"className":587},[],[589],{"type":50,"value":590},".webhook",{"type":50,"value":577},{"type":45,"tag":238,"props":593,"children":595},{"className":594},[],[596],{"type":50,"value":597},".pagerduty",{"type":50,"value":577},{"type":45,"tag":238,"props":600,"children":602},{"className":601},[],[603],{"type":50,"value":604},".jira",{"type":50,"value":606},")",{"type":45,"tag":96,"props":608,"children":609},{},[610,619,624],{"type":45,"tag":118,"props":611,"children":612},{},[613],{"type":45,"tag":238,"props":614,"children":616},{"className":615},[],[617],{"type":50,"value":618},"config",{"type":45,"tag":118,"props":620,"children":621},{},[622],{"type":50,"value":623},"object",{"type":45,"tag":118,"props":625,"children":626},{},[627],{"type":50,"value":628},"Type-specific configuration (non-secret settings)",{"type":45,"tag":96,"props":630,"children":631},{},[632,641,645],{"type":45,"tag":118,"props":633,"children":634},{},[635],{"type":45,"tag":238,"props":636,"children":638},{"className":637},[],[639],{"type":50,"value":640},"secrets",{"type":45,"tag":118,"props":642,"children":643},{},[644],{"type":50,"value":623},{"type":45,"tag":118,"props":646,"children":647},{},[648],{"type":50,"value":649},"Type-specific secrets (API keys, passwords, tokens)",{"type":45,"tag":81,"props":651,"children":653},{"id":652},"example-create-a-slack-connector-webhook",[654],{"type":50,"value":655},"Example: Create a Slack Connector (Webhook)",{"type":45,"tag":247,"props":657,"children":661},{"className":658,"code":659,"language":660,"meta":252,"style":252},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n  -d '{\n    \"name\": \"Production Slack Alerts\",\n    \"connector_type_id\": \".slack\",\n    \"config\": {},\n    \"secrets\": {\n      \"webhookUrl\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n    }\n  }'\n","bash",[662],{"type":45,"tag":238,"props":663,"children":664},{"__ignoreMap":252},[665,707,733,758,783,802,811,820,829,838,847,856],{"type":45,"tag":258,"props":666,"children":667},{"class":260,"line":261},[668,674,680,685,691,696,701],{"type":45,"tag":258,"props":669,"children":671},{"style":670},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[672],{"type":50,"value":673},"curl",{"type":45,"tag":258,"props":675,"children":677},{"style":676},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[678],{"type":50,"value":679}," -X",{"type":45,"tag":258,"props":681,"children":682},{"style":676},[683],{"type":50,"value":684}," POST",{"type":45,"tag":258,"props":686,"children":688},{"style":687},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[689],{"type":50,"value":690}," \"",{"type":45,"tag":258,"props":692,"children":693},{"style":676},[694],{"type":50,"value":695},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector",{"type":45,"tag":258,"props":697,"children":698},{"style":687},[699],{"type":50,"value":700},"\"",{"type":45,"tag":258,"props":702,"children":704},{"style":703},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[705],{"type":50,"value":706}," \\\n",{"type":45,"tag":258,"props":708,"children":710},{"class":260,"line":709},2,[711,716,720,725,729],{"type":45,"tag":258,"props":712,"children":713},{"style":676},[714],{"type":50,"value":715},"  -H",{"type":45,"tag":258,"props":717,"children":718},{"style":687},[719],{"type":50,"value":690},{"type":45,"tag":258,"props":721,"children":722},{"style":676},[723],{"type":50,"value":724},"kbn-xsrf: true",{"type":45,"tag":258,"props":726,"children":727},{"style":687},[728],{"type":50,"value":700},{"type":45,"tag":258,"props":730,"children":731},{"style":703},[732],{"type":50,"value":706},{"type":45,"tag":258,"props":734,"children":736},{"class":260,"line":735},3,[737,741,745,750,754],{"type":45,"tag":258,"props":738,"children":739},{"style":676},[740],{"type":50,"value":715},{"type":45,"tag":258,"props":742,"children":743},{"style":687},[744],{"type":50,"value":690},{"type":45,"tag":258,"props":746,"children":747},{"style":676},[748],{"type":50,"value":749},"Content-Type: application\u002Fjson",{"type":45,"tag":258,"props":751,"children":752},{"style":687},[753],{"type":50,"value":700},{"type":45,"tag":258,"props":755,"children":756},{"style":703},[757],{"type":50,"value":706},{"type":45,"tag":258,"props":759,"children":761},{"class":260,"line":760},4,[762,766,770,775,779],{"type":45,"tag":258,"props":763,"children":764},{"style":676},[765],{"type":50,"value":715},{"type":45,"tag":258,"props":767,"children":768},{"style":687},[769],{"type":50,"value":690},{"type":45,"tag":258,"props":771,"children":772},{"style":676},[773],{"type":50,"value":774},"Authorization: ApiKey \u003Cyour-api-key>",{"type":45,"tag":258,"props":776,"children":777},{"style":687},[778],{"type":50,"value":700},{"type":45,"tag":258,"props":780,"children":781},{"style":703},[782],{"type":50,"value":706},{"type":45,"tag":258,"props":784,"children":786},{"class":260,"line":785},5,[787,792,797],{"type":45,"tag":258,"props":788,"children":789},{"style":676},[790],{"type":50,"value":791},"  -d",{"type":45,"tag":258,"props":793,"children":794},{"style":687},[795],{"type":50,"value":796}," '",{"type":45,"tag":258,"props":798,"children":799},{"style":676},[800],{"type":50,"value":801},"{\n",{"type":45,"tag":258,"props":803,"children":805},{"class":260,"line":804},6,[806],{"type":45,"tag":258,"props":807,"children":808},{"style":676},[809],{"type":50,"value":810},"    \"name\": \"Production Slack Alerts\",\n",{"type":45,"tag":258,"props":812,"children":814},{"class":260,"line":813},7,[815],{"type":45,"tag":258,"props":816,"children":817},{"style":676},[818],{"type":50,"value":819},"    \"connector_type_id\": \".slack\",\n",{"type":45,"tag":258,"props":821,"children":823},{"class":260,"line":822},8,[824],{"type":45,"tag":258,"props":825,"children":826},{"style":676},[827],{"type":50,"value":828},"    \"config\": {},\n",{"type":45,"tag":258,"props":830,"children":832},{"class":260,"line":831},9,[833],{"type":45,"tag":258,"props":834,"children":835},{"style":676},[836],{"type":50,"value":837},"    \"secrets\": {\n",{"type":45,"tag":258,"props":839,"children":841},{"class":260,"line":840},10,[842],{"type":45,"tag":258,"props":843,"children":844},{"style":676},[845],{"type":50,"value":846},"      \"webhookUrl\": \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n",{"type":45,"tag":258,"props":848,"children":850},{"class":260,"line":849},11,[851],{"type":45,"tag":258,"props":852,"children":853},{"style":676},[854],{"type":50,"value":855},"    }\n",{"type":45,"tag":258,"props":857,"children":859},{"class":260,"line":858},12,[860,865],{"type":45,"tag":258,"props":861,"children":862},{"style":676},[863],{"type":50,"value":864},"  }",{"type":45,"tag":258,"props":866,"children":867},{"style":687},[868],{"type":50,"value":869},"'\n",{"type":45,"tag":60,"props":871,"children":872},{},[873,875,880,881,886,888,893,895,902],{"type":50,"value":874},"All connector types share the same request structure — only ",{"type":45,"tag":238,"props":876,"children":878},{"className":877},[],[879],{"type":50,"value":560},{"type":50,"value":577},{"type":45,"tag":238,"props":882,"children":884},{"className":883},[],[885],{"type":50,"value":618},{"type":50,"value":887},", and ",{"type":45,"tag":238,"props":889,"children":891},{"className":890},[],[892],{"type":50,"value":640},{"type":50,"value":894}," differ. See the\n",{"type":45,"tag":896,"props":897,"children":899},"a",{"href":898},"#common-connector-type-ids",[900],{"type":50,"value":901},"Common Connector Type IDs",{"type":50,"value":903}," table for available types and their required fields.",{"type":45,"tag":81,"props":905,"children":907},{"id":906},"example-create-a-pagerduty-connector",[908],{"type":50,"value":909},"Example: Create a PagerDuty Connector",{"type":45,"tag":247,"props":911,"children":913},{"className":658,"code":912,"language":660,"meta":252,"style":252},"curl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-pagerduty\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n  -d '{\n    \"name\": \"PagerDuty Incidents\",\n    \"connector_type_id\": \".pagerduty\",\n    \"config\": {\n      \"apiUrl\": \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\"\n    },\n    \"secrets\": {\n      \"routingKey\": \"your-pagerduty-integration-key\"\n    }\n  }'\n",[914],{"type":45,"tag":238,"props":915,"children":916},{"__ignoreMap":252},[917,949,972,995,1018,1033,1041,1049,1057,1065,1073,1080,1088,1096],{"type":45,"tag":258,"props":918,"children":919},{"class":260,"line":261},[920,924,928,932,936,941,945],{"type":45,"tag":258,"props":921,"children":922},{"style":670},[923],{"type":50,"value":673},{"type":45,"tag":258,"props":925,"children":926},{"style":676},[927],{"type":50,"value":679},{"type":45,"tag":258,"props":929,"children":930},{"style":676},[931],{"type":50,"value":684},{"type":45,"tag":258,"props":933,"children":934},{"style":687},[935],{"type":50,"value":690},{"type":45,"tag":258,"props":937,"children":938},{"style":676},[939],{"type":50,"value":940},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-pagerduty",{"type":45,"tag":258,"props":942,"children":943},{"style":687},[944],{"type":50,"value":700},{"type":45,"tag":258,"props":946,"children":947},{"style":703},[948],{"type":50,"value":706},{"type":45,"tag":258,"props":950,"children":951},{"class":260,"line":709},[952,956,960,964,968],{"type":45,"tag":258,"props":953,"children":954},{"style":676},[955],{"type":50,"value":715},{"type":45,"tag":258,"props":957,"children":958},{"style":687},[959],{"type":50,"value":690},{"type":45,"tag":258,"props":961,"children":962},{"style":676},[963],{"type":50,"value":724},{"type":45,"tag":258,"props":965,"children":966},{"style":687},[967],{"type":50,"value":700},{"type":45,"tag":258,"props":969,"children":970},{"style":703},[971],{"type":50,"value":706},{"type":45,"tag":258,"props":973,"children":974},{"class":260,"line":735},[975,979,983,987,991],{"type":45,"tag":258,"props":976,"children":977},{"style":676},[978],{"type":50,"value":715},{"type":45,"tag":258,"props":980,"children":981},{"style":687},[982],{"type":50,"value":690},{"type":45,"tag":258,"props":984,"children":985},{"style":676},[986],{"type":50,"value":749},{"type":45,"tag":258,"props":988,"children":989},{"style":687},[990],{"type":50,"value":700},{"type":45,"tag":258,"props":992,"children":993},{"style":703},[994],{"type":50,"value":706},{"type":45,"tag":258,"props":996,"children":997},{"class":260,"line":760},[998,1002,1006,1010,1014],{"type":45,"tag":258,"props":999,"children":1000},{"style":676},[1001],{"type":50,"value":715},{"type":45,"tag":258,"props":1003,"children":1004},{"style":687},[1005],{"type":50,"value":690},{"type":45,"tag":258,"props":1007,"children":1008},{"style":676},[1009],{"type":50,"value":774},{"type":45,"tag":258,"props":1011,"children":1012},{"style":687},[1013],{"type":50,"value":700},{"type":45,"tag":258,"props":1015,"children":1016},{"style":703},[1017],{"type":50,"value":706},{"type":45,"tag":258,"props":1019,"children":1020},{"class":260,"line":785},[1021,1025,1029],{"type":45,"tag":258,"props":1022,"children":1023},{"style":676},[1024],{"type":50,"value":791},{"type":45,"tag":258,"props":1026,"children":1027},{"style":687},[1028],{"type":50,"value":796},{"type":45,"tag":258,"props":1030,"children":1031},{"style":676},[1032],{"type":50,"value":801},{"type":45,"tag":258,"props":1034,"children":1035},{"class":260,"line":804},[1036],{"type":45,"tag":258,"props":1037,"children":1038},{"style":676},[1039],{"type":50,"value":1040},"    \"name\": \"PagerDuty Incidents\",\n",{"type":45,"tag":258,"props":1042,"children":1043},{"class":260,"line":813},[1044],{"type":45,"tag":258,"props":1045,"children":1046},{"style":676},[1047],{"type":50,"value":1048},"    \"connector_type_id\": \".pagerduty\",\n",{"type":45,"tag":258,"props":1050,"children":1051},{"class":260,"line":822},[1052],{"type":45,"tag":258,"props":1053,"children":1054},{"style":676},[1055],{"type":50,"value":1056},"    \"config\": {\n",{"type":45,"tag":258,"props":1058,"children":1059},{"class":260,"line":831},[1060],{"type":45,"tag":258,"props":1061,"children":1062},{"style":676},[1063],{"type":50,"value":1064},"      \"apiUrl\": \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\"\n",{"type":45,"tag":258,"props":1066,"children":1067},{"class":260,"line":840},[1068],{"type":45,"tag":258,"props":1069,"children":1070},{"style":676},[1071],{"type":50,"value":1072},"    },\n",{"type":45,"tag":258,"props":1074,"children":1075},{"class":260,"line":849},[1076],{"type":45,"tag":258,"props":1077,"children":1078},{"style":676},[1079],{"type":50,"value":837},{"type":45,"tag":258,"props":1081,"children":1082},{"class":260,"line":858},[1083],{"type":45,"tag":258,"props":1084,"children":1085},{"style":676},[1086],{"type":50,"value":1087},"      \"routingKey\": \"your-pagerduty-integration-key\"\n",{"type":45,"tag":258,"props":1089,"children":1091},{"class":260,"line":1090},13,[1092],{"type":45,"tag":258,"props":1093,"children":1094},{"style":676},[1095],{"type":50,"value":855},{"type":45,"tag":258,"props":1097,"children":1099},{"class":260,"line":1098},14,[1100,1104],{"type":45,"tag":258,"props":1101,"children":1102},{"style":676},[1103],{"type":50,"value":864},{"type":45,"tag":258,"props":1105,"children":1106},{"style":687},[1107],{"type":50,"value":869},{"type":45,"tag":53,"props":1109,"children":1111},{"id":1110},"updating-a-connector",[1112],{"type":50,"value":1113},"Updating a Connector",{"type":45,"tag":60,"props":1115,"children":1116},{},[1117,1123,1125,1130],{"type":45,"tag":238,"props":1118,"children":1120},{"className":1119},[],[1121],{"type":50,"value":1122},"PUT \u002Fapi\u002Factions\u002Fconnector\u002F{id}",{"type":50,"value":1124}," replaces the full configuration. ",{"type":45,"tag":238,"props":1126,"children":1128},{"className":1127},[],[1129],{"type":50,"value":560},{"type":50,"value":1131}," is immutable — delete and\nrecreate to change it.",{"type":45,"tag":53,"props":1133,"children":1135},{"id":1134},"listing-and-discovering-connectors",[1136],{"type":50,"value":1137},"Listing and Discovering Connectors",{"type":45,"tag":247,"props":1139,"children":1141},{"className":658,"code":1140,"language":660,"meta":252,"style":252},"# Get all connectors in the current space\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnectors\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n\n# Get available connector types\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector_types\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n\n# Filter connector types by feature (e.g., only those supporting alerting)\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector_types?feature_id=alerting\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n",[1142],{"type":45,"tag":238,"props":1143,"children":1144},{"__ignoreMap":252},[1145,1154,1187,1207,1216,1224,1256,1275,1282,1290,1322],{"type":45,"tag":258,"props":1146,"children":1147},{"class":260,"line":261},[1148],{"type":45,"tag":258,"props":1149,"children":1151},{"style":1150},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1152],{"type":50,"value":1153},"# Get all connectors in the current space\n",{"type":45,"tag":258,"props":1155,"children":1156},{"class":260,"line":709},[1157,1161,1165,1170,1174,1179,1183],{"type":45,"tag":258,"props":1158,"children":1159},{"style":670},[1160],{"type":50,"value":673},{"type":45,"tag":258,"props":1162,"children":1163},{"style":676},[1164],{"type":50,"value":679},{"type":45,"tag":258,"props":1166,"children":1167},{"style":676},[1168],{"type":50,"value":1169}," GET",{"type":45,"tag":258,"props":1171,"children":1172},{"style":687},[1173],{"type":50,"value":690},{"type":45,"tag":258,"props":1175,"children":1176},{"style":676},[1177],{"type":50,"value":1178},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnectors",{"type":45,"tag":258,"props":1180,"children":1181},{"style":687},[1182],{"type":50,"value":700},{"type":45,"tag":258,"props":1184,"children":1185},{"style":703},[1186],{"type":50,"value":706},{"type":45,"tag":258,"props":1188,"children":1189},{"class":260,"line":735},[1190,1194,1198,1202],{"type":45,"tag":258,"props":1191,"children":1192},{"style":676},[1193],{"type":50,"value":715},{"type":45,"tag":258,"props":1195,"children":1196},{"style":687},[1197],{"type":50,"value":690},{"type":45,"tag":258,"props":1199,"children":1200},{"style":676},[1201],{"type":50,"value":774},{"type":45,"tag":258,"props":1203,"children":1204},{"style":687},[1205],{"type":50,"value":1206},"\"\n",{"type":45,"tag":258,"props":1208,"children":1209},{"class":260,"line":760},[1210],{"type":45,"tag":258,"props":1211,"children":1213},{"emptyLinePlaceholder":1212},true,[1214],{"type":50,"value":1215},"\n",{"type":45,"tag":258,"props":1217,"children":1218},{"class":260,"line":785},[1219],{"type":45,"tag":258,"props":1220,"children":1221},{"style":1150},[1222],{"type":50,"value":1223},"# Get available connector types\n",{"type":45,"tag":258,"props":1225,"children":1226},{"class":260,"line":804},[1227,1231,1235,1239,1243,1248,1252],{"type":45,"tag":258,"props":1228,"children":1229},{"style":670},[1230],{"type":50,"value":673},{"type":45,"tag":258,"props":1232,"children":1233},{"style":676},[1234],{"type":50,"value":679},{"type":45,"tag":258,"props":1236,"children":1237},{"style":676},[1238],{"type":50,"value":1169},{"type":45,"tag":258,"props":1240,"children":1241},{"style":687},[1242],{"type":50,"value":690},{"type":45,"tag":258,"props":1244,"children":1245},{"style":676},[1246],{"type":50,"value":1247},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector_types",{"type":45,"tag":258,"props":1249,"children":1250},{"style":687},[1251],{"type":50,"value":700},{"type":45,"tag":258,"props":1253,"children":1254},{"style":703},[1255],{"type":50,"value":706},{"type":45,"tag":258,"props":1257,"children":1258},{"class":260,"line":813},[1259,1263,1267,1271],{"type":45,"tag":258,"props":1260,"children":1261},{"style":676},[1262],{"type":50,"value":715},{"type":45,"tag":258,"props":1264,"children":1265},{"style":687},[1266],{"type":50,"value":690},{"type":45,"tag":258,"props":1268,"children":1269},{"style":676},[1270],{"type":50,"value":774},{"type":45,"tag":258,"props":1272,"children":1273},{"style":687},[1274],{"type":50,"value":1206},{"type":45,"tag":258,"props":1276,"children":1277},{"class":260,"line":822},[1278],{"type":45,"tag":258,"props":1279,"children":1280},{"emptyLinePlaceholder":1212},[1281],{"type":50,"value":1215},{"type":45,"tag":258,"props":1283,"children":1284},{"class":260,"line":831},[1285],{"type":45,"tag":258,"props":1286,"children":1287},{"style":1150},[1288],{"type":50,"value":1289},"# Filter connector types by feature (e.g., only those supporting alerting)\n",{"type":45,"tag":258,"props":1291,"children":1292},{"class":260,"line":840},[1293,1297,1301,1305,1309,1314,1318],{"type":45,"tag":258,"props":1294,"children":1295},{"style":670},[1296],{"type":50,"value":673},{"type":45,"tag":258,"props":1298,"children":1299},{"style":676},[1300],{"type":50,"value":679},{"type":45,"tag":258,"props":1302,"children":1303},{"style":676},[1304],{"type":50,"value":1169},{"type":45,"tag":258,"props":1306,"children":1307},{"style":687},[1308],{"type":50,"value":690},{"type":45,"tag":258,"props":1310,"children":1311},{"style":676},[1312],{"type":50,"value":1313},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector_types?feature_id=alerting",{"type":45,"tag":258,"props":1315,"children":1316},{"style":687},[1317],{"type":50,"value":700},{"type":45,"tag":258,"props":1319,"children":1320},{"style":703},[1321],{"type":50,"value":706},{"type":45,"tag":258,"props":1323,"children":1324},{"class":260,"line":849},[1325,1329,1333,1337],{"type":45,"tag":258,"props":1326,"children":1327},{"style":676},[1328],{"type":50,"value":715},{"type":45,"tag":258,"props":1330,"children":1331},{"style":687},[1332],{"type":50,"value":690},{"type":45,"tag":258,"props":1334,"children":1335},{"style":676},[1336],{"type":50,"value":774},{"type":45,"tag":258,"props":1338,"children":1339},{"style":687},[1340],{"type":50,"value":1206},{"type":45,"tag":60,"props":1342,"children":1343},{},[1344,1346,1352,1354,1360],{"type":50,"value":1345},"The ",{"type":45,"tag":238,"props":1347,"children":1349},{"className":1348},[],[1350],{"type":50,"value":1351},"GET \u002Fapi\u002Factions\u002Fconnectors",{"type":50,"value":1353}," response includes ",{"type":45,"tag":238,"props":1355,"children":1357},{"className":1356},[],[1358],{"type":50,"value":1359},"referenced_by_count",{"type":50,"value":1361}," showing how many rules use each connector.\nAlways check this before deleting.",{"type":45,"tag":53,"props":1363,"children":1365},{"id":1364},"running-a-connector-test",[1366],{"type":50,"value":1367},"Running a Connector (Test)",{"type":45,"tag":60,"props":1369,"children":1370},{},[1371],{"type":50,"value":1372},"Execute a connector action directly, useful for testing connectivity.",{"type":45,"tag":247,"props":1374,"children":1376},{"className":658,"code":1375,"language":660,"meta":252,"style":252},"curl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\u002F_execute\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n  -d '{\n    \"params\": {\n      \"message\": \"Test alert from API\"\n    }\n  }'\n",[1377],{"type":45,"tag":238,"props":1378,"children":1379},{"__ignoreMap":252},[1380,1412,1435,1458,1481,1496,1504,1512,1519],{"type":45,"tag":258,"props":1381,"children":1382},{"class":260,"line":261},[1383,1387,1391,1395,1399,1404,1408],{"type":45,"tag":258,"props":1384,"children":1385},{"style":670},[1386],{"type":50,"value":673},{"type":45,"tag":258,"props":1388,"children":1389},{"style":676},[1390],{"type":50,"value":679},{"type":45,"tag":258,"props":1392,"children":1393},{"style":676},[1394],{"type":50,"value":684},{"type":45,"tag":258,"props":1396,"children":1397},{"style":687},[1398],{"type":50,"value":690},{"type":45,"tag":258,"props":1400,"children":1401},{"style":676},[1402],{"type":50,"value":1403},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\u002F_execute",{"type":45,"tag":258,"props":1405,"children":1406},{"style":687},[1407],{"type":50,"value":700},{"type":45,"tag":258,"props":1409,"children":1410},{"style":703},[1411],{"type":50,"value":706},{"type":45,"tag":258,"props":1413,"children":1414},{"class":260,"line":709},[1415,1419,1423,1427,1431],{"type":45,"tag":258,"props":1416,"children":1417},{"style":676},[1418],{"type":50,"value":715},{"type":45,"tag":258,"props":1420,"children":1421},{"style":687},[1422],{"type":50,"value":690},{"type":45,"tag":258,"props":1424,"children":1425},{"style":676},[1426],{"type":50,"value":724},{"type":45,"tag":258,"props":1428,"children":1429},{"style":687},[1430],{"type":50,"value":700},{"type":45,"tag":258,"props":1432,"children":1433},{"style":703},[1434],{"type":50,"value":706},{"type":45,"tag":258,"props":1436,"children":1437},{"class":260,"line":735},[1438,1442,1446,1450,1454],{"type":45,"tag":258,"props":1439,"children":1440},{"style":676},[1441],{"type":50,"value":715},{"type":45,"tag":258,"props":1443,"children":1444},{"style":687},[1445],{"type":50,"value":690},{"type":45,"tag":258,"props":1447,"children":1448},{"style":676},[1449],{"type":50,"value":749},{"type":45,"tag":258,"props":1451,"children":1452},{"style":687},[1453],{"type":50,"value":700},{"type":45,"tag":258,"props":1455,"children":1456},{"style":703},[1457],{"type":50,"value":706},{"type":45,"tag":258,"props":1459,"children":1460},{"class":260,"line":760},[1461,1465,1469,1473,1477],{"type":45,"tag":258,"props":1462,"children":1463},{"style":676},[1464],{"type":50,"value":715},{"type":45,"tag":258,"props":1466,"children":1467},{"style":687},[1468],{"type":50,"value":690},{"type":45,"tag":258,"props":1470,"children":1471},{"style":676},[1472],{"type":50,"value":774},{"type":45,"tag":258,"props":1474,"children":1475},{"style":687},[1476],{"type":50,"value":700},{"type":45,"tag":258,"props":1478,"children":1479},{"style":703},[1480],{"type":50,"value":706},{"type":45,"tag":258,"props":1482,"children":1483},{"class":260,"line":785},[1484,1488,1492],{"type":45,"tag":258,"props":1485,"children":1486},{"style":676},[1487],{"type":50,"value":791},{"type":45,"tag":258,"props":1489,"children":1490},{"style":687},[1491],{"type":50,"value":796},{"type":45,"tag":258,"props":1493,"children":1494},{"style":676},[1495],{"type":50,"value":801},{"type":45,"tag":258,"props":1497,"children":1498},{"class":260,"line":804},[1499],{"type":45,"tag":258,"props":1500,"children":1501},{"style":676},[1502],{"type":50,"value":1503},"    \"params\": {\n",{"type":45,"tag":258,"props":1505,"children":1506},{"class":260,"line":813},[1507],{"type":45,"tag":258,"props":1508,"children":1509},{"style":676},[1510],{"type":50,"value":1511},"      \"message\": \"Test alert from API\"\n",{"type":45,"tag":258,"props":1513,"children":1514},{"class":260,"line":822},[1515],{"type":45,"tag":258,"props":1516,"children":1517},{"style":676},[1518],{"type":50,"value":855},{"type":45,"tag":258,"props":1520,"children":1521},{"class":260,"line":831},[1522,1526],{"type":45,"tag":258,"props":1523,"children":1524},{"style":676},[1525],{"type":50,"value":864},{"type":45,"tag":258,"props":1527,"children":1528},{"style":687},[1529],{"type":50,"value":869},{"type":45,"tag":53,"props":1531,"children":1533},{"id":1532},"deleting-a-connector",[1534],{"type":50,"value":1535},"Deleting a Connector",{"type":45,"tag":247,"props":1537,"children":1539},{"className":658,"code":1538,"language":660,"meta":252,"style":252},"curl -X DELETE \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Factions\u002Fconnector\u002Fmy-slack-connector\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n",[1540],{"type":45,"tag":238,"props":1541,"children":1542},{"__ignoreMap":252},[1543,1575,1598],{"type":45,"tag":258,"props":1544,"children":1545},{"class":260,"line":261},[1546,1550,1554,1559,1563,1567,1571],{"type":45,"tag":258,"props":1547,"children":1548},{"style":670},[1549],{"type":50,"value":673},{"type":45,"tag":258,"props":1551,"children":1552},{"style":676},[1553],{"type":50,"value":679},{"type":45,"tag":258,"props":1555,"children":1556},{"style":676},[1557],{"type":50,"value":1558}," DELETE",{"type":45,"tag":258,"props":1560,"children":1561},{"style":687},[1562],{"type":50,"value":690},{"type":45,"tag":258,"props":1564,"children":1565},{"style":676},[1566],{"type":50,"value":695},{"type":45,"tag":258,"props":1568,"children":1569},{"style":687},[1570],{"type":50,"value":700},{"type":45,"tag":258,"props":1572,"children":1573},{"style":703},[1574],{"type":50,"value":706},{"type":45,"tag":258,"props":1576,"children":1577},{"class":260,"line":709},[1578,1582,1586,1590,1594],{"type":45,"tag":258,"props":1579,"children":1580},{"style":676},[1581],{"type":50,"value":715},{"type":45,"tag":258,"props":1583,"children":1584},{"style":687},[1585],{"type":50,"value":690},{"type":45,"tag":258,"props":1587,"children":1588},{"style":676},[1589],{"type":50,"value":724},{"type":45,"tag":258,"props":1591,"children":1592},{"style":687},[1593],{"type":50,"value":700},{"type":45,"tag":258,"props":1595,"children":1596},{"style":703},[1597],{"type":50,"value":706},{"type":45,"tag":258,"props":1599,"children":1600},{"class":260,"line":735},[1601,1605,1609,1613],{"type":45,"tag":258,"props":1602,"children":1603},{"style":676},[1604],{"type":50,"value":715},{"type":45,"tag":258,"props":1606,"children":1607},{"style":687},[1608],{"type":50,"value":690},{"type":45,"tag":258,"props":1610,"children":1611},{"style":676},[1612],{"type":50,"value":774},{"type":45,"tag":258,"props":1614,"children":1615},{"style":687},[1616],{"type":50,"value":1206},{"type":45,"tag":60,"props":1618,"children":1619},{},[1620,1625,1627,1632],{"type":45,"tag":66,"props":1621,"children":1622},{},[1623],{"type":50,"value":1624},"Warning:",{"type":50,"value":1626}," Deleting a connector that is referenced by rules will cause those rule actions to fail silently. Check\n",{"type":45,"tag":238,"props":1628,"children":1630},{"className":1629},[],[1631],{"type":50,"value":1359},{"type":50,"value":1633}," first.",{"type":45,"tag":53,"props":1635,"children":1637},{"id":1636},"terraform-provider",[1638],{"type":50,"value":1639},"Terraform Provider",{"type":45,"tag":60,"props":1641,"children":1642},{},[1643,1645,1651,1653,1659],{"type":50,"value":1644},"Use the ",{"type":45,"tag":238,"props":1646,"children":1648},{"className":1647},[],[1649],{"type":50,"value":1650},"elasticstack",{"type":50,"value":1652}," provider resource ",{"type":45,"tag":238,"props":1654,"children":1656},{"className":1655},[],[1657],{"type":50,"value":1658},"elasticstack_kibana_action_connector",{"type":50,"value":1660},".",{"type":45,"tag":247,"props":1662,"children":1666},{"className":1663,"code":1664,"language":1665,"meta":252,"style":252},"language-hcl shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","terraform {\n  required_providers {\n    elasticstack = {\n      source  = \"elastic\u002Felasticstack\"\n    }\n  }\n}\n\nprovider \"elasticstack\" {\n  kibana {\n    endpoints = [\"https:\u002F\u002Fmy-kibana:5601\"]\n    api_key   = var.kibana_api_key\n  }\n}\n\nresource \"elasticstack_kibana_action_connector\" \"slack\" {\n  name              = \"Production Slack Alerts\"\n  connector_type_id = \".slack\"\n\n  config = jsonencode({})\n\n  secrets = jsonencode({\n    webhookUrl = \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n  })\n}\n\nresource \"elasticstack_kibana_action_connector\" \"index\" {\n  name              = \"Alert Index Writer\"\n  connector_type_id = \".index\"\n\n  config = jsonencode({\n    index              = \"alert-history\"\n    executionTimeField = \"@timestamp\"\n  })\n\n  secrets = jsonencode({})\n}\n","hcl",[1667],{"type":45,"tag":238,"props":1668,"children":1669},{"__ignoreMap":252},[1670,1678,1686,1694,1702,1709,1717,1725,1732,1740,1748,1756,1764,1771,1778,1786,1795,1804,1813,1821,1830,1838,1847,1856,1865,1873,1881,1890,1899,1908,1916,1925,1934,1943,1951,1959,1968],{"type":45,"tag":258,"props":1671,"children":1672},{"class":260,"line":261},[1673],{"type":45,"tag":258,"props":1674,"children":1675},{},[1676],{"type":50,"value":1677},"terraform {\n",{"type":45,"tag":258,"props":1679,"children":1680},{"class":260,"line":709},[1681],{"type":45,"tag":258,"props":1682,"children":1683},{},[1684],{"type":50,"value":1685},"  required_providers {\n",{"type":45,"tag":258,"props":1687,"children":1688},{"class":260,"line":735},[1689],{"type":45,"tag":258,"props":1690,"children":1691},{},[1692],{"type":50,"value":1693},"    elasticstack = {\n",{"type":45,"tag":258,"props":1695,"children":1696},{"class":260,"line":760},[1697],{"type":45,"tag":258,"props":1698,"children":1699},{},[1700],{"type":50,"value":1701},"      source  = \"elastic\u002Felasticstack\"\n",{"type":45,"tag":258,"props":1703,"children":1704},{"class":260,"line":785},[1705],{"type":45,"tag":258,"props":1706,"children":1707},{},[1708],{"type":50,"value":855},{"type":45,"tag":258,"props":1710,"children":1711},{"class":260,"line":804},[1712],{"type":45,"tag":258,"props":1713,"children":1714},{},[1715],{"type":50,"value":1716},"  }\n",{"type":45,"tag":258,"props":1718,"children":1719},{"class":260,"line":813},[1720],{"type":45,"tag":258,"props":1721,"children":1722},{},[1723],{"type":50,"value":1724},"}\n",{"type":45,"tag":258,"props":1726,"children":1727},{"class":260,"line":822},[1728],{"type":45,"tag":258,"props":1729,"children":1730},{"emptyLinePlaceholder":1212},[1731],{"type":50,"value":1215},{"type":45,"tag":258,"props":1733,"children":1734},{"class":260,"line":831},[1735],{"type":45,"tag":258,"props":1736,"children":1737},{},[1738],{"type":50,"value":1739},"provider \"elasticstack\" {\n",{"type":45,"tag":258,"props":1741,"children":1742},{"class":260,"line":840},[1743],{"type":45,"tag":258,"props":1744,"children":1745},{},[1746],{"type":50,"value":1747},"  kibana {\n",{"type":45,"tag":258,"props":1749,"children":1750},{"class":260,"line":849},[1751],{"type":45,"tag":258,"props":1752,"children":1753},{},[1754],{"type":50,"value":1755},"    endpoints = [\"https:\u002F\u002Fmy-kibana:5601\"]\n",{"type":45,"tag":258,"props":1757,"children":1758},{"class":260,"line":858},[1759],{"type":45,"tag":258,"props":1760,"children":1761},{},[1762],{"type":50,"value":1763},"    api_key   = var.kibana_api_key\n",{"type":45,"tag":258,"props":1765,"children":1766},{"class":260,"line":1090},[1767],{"type":45,"tag":258,"props":1768,"children":1769},{},[1770],{"type":50,"value":1716},{"type":45,"tag":258,"props":1772,"children":1773},{"class":260,"line":1098},[1774],{"type":45,"tag":258,"props":1775,"children":1776},{},[1777],{"type":50,"value":1724},{"type":45,"tag":258,"props":1779,"children":1781},{"class":260,"line":1780},15,[1782],{"type":45,"tag":258,"props":1783,"children":1784},{"emptyLinePlaceholder":1212},[1785],{"type":50,"value":1215},{"type":45,"tag":258,"props":1787,"children":1789},{"class":260,"line":1788},16,[1790],{"type":45,"tag":258,"props":1791,"children":1792},{},[1793],{"type":50,"value":1794},"resource \"elasticstack_kibana_action_connector\" \"slack\" {\n",{"type":45,"tag":258,"props":1796,"children":1798},{"class":260,"line":1797},17,[1799],{"type":45,"tag":258,"props":1800,"children":1801},{},[1802],{"type":50,"value":1803},"  name              = \"Production Slack Alerts\"\n",{"type":45,"tag":258,"props":1805,"children":1807},{"class":260,"line":1806},18,[1808],{"type":45,"tag":258,"props":1809,"children":1810},{},[1811],{"type":50,"value":1812},"  connector_type_id = \".slack\"\n",{"type":45,"tag":258,"props":1814,"children":1816},{"class":260,"line":1815},19,[1817],{"type":45,"tag":258,"props":1818,"children":1819},{"emptyLinePlaceholder":1212},[1820],{"type":50,"value":1215},{"type":45,"tag":258,"props":1822,"children":1824},{"class":260,"line":1823},20,[1825],{"type":45,"tag":258,"props":1826,"children":1827},{},[1828],{"type":50,"value":1829},"  config = jsonencode({})\n",{"type":45,"tag":258,"props":1831,"children":1833},{"class":260,"line":1832},21,[1834],{"type":45,"tag":258,"props":1835,"children":1836},{"emptyLinePlaceholder":1212},[1837],{"type":50,"value":1215},{"type":45,"tag":258,"props":1839,"children":1841},{"class":260,"line":1840},22,[1842],{"type":45,"tag":258,"props":1843,"children":1844},{},[1845],{"type":50,"value":1846},"  secrets = jsonencode({\n",{"type":45,"tag":258,"props":1848,"children":1850},{"class":260,"line":1849},23,[1851],{"type":45,"tag":258,"props":1852,"children":1853},{},[1854],{"type":50,"value":1855},"    webhookUrl = \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n",{"type":45,"tag":258,"props":1857,"children":1859},{"class":260,"line":1858},24,[1860],{"type":45,"tag":258,"props":1861,"children":1862},{},[1863],{"type":50,"value":1864},"  })\n",{"type":45,"tag":258,"props":1866,"children":1868},{"class":260,"line":1867},25,[1869],{"type":45,"tag":258,"props":1870,"children":1871},{},[1872],{"type":50,"value":1724},{"type":45,"tag":258,"props":1874,"children":1876},{"class":260,"line":1875},26,[1877],{"type":45,"tag":258,"props":1878,"children":1879},{"emptyLinePlaceholder":1212},[1880],{"type":50,"value":1215},{"type":45,"tag":258,"props":1882,"children":1884},{"class":260,"line":1883},27,[1885],{"type":45,"tag":258,"props":1886,"children":1887},{},[1888],{"type":50,"value":1889},"resource \"elasticstack_kibana_action_connector\" \"index\" {\n",{"type":45,"tag":258,"props":1891,"children":1893},{"class":260,"line":1892},28,[1894],{"type":45,"tag":258,"props":1895,"children":1896},{},[1897],{"type":50,"value":1898},"  name              = \"Alert Index Writer\"\n",{"type":45,"tag":258,"props":1900,"children":1902},{"class":260,"line":1901},29,[1903],{"type":45,"tag":258,"props":1904,"children":1905},{},[1906],{"type":50,"value":1907},"  connector_type_id = \".index\"\n",{"type":45,"tag":258,"props":1909,"children":1911},{"class":260,"line":1910},30,[1912],{"type":45,"tag":258,"props":1913,"children":1914},{"emptyLinePlaceholder":1212},[1915],{"type":50,"value":1215},{"type":45,"tag":258,"props":1917,"children":1919},{"class":260,"line":1918},31,[1920],{"type":45,"tag":258,"props":1921,"children":1922},{},[1923],{"type":50,"value":1924},"  config = jsonencode({\n",{"type":45,"tag":258,"props":1926,"children":1928},{"class":260,"line":1927},32,[1929],{"type":45,"tag":258,"props":1930,"children":1931},{},[1932],{"type":50,"value":1933},"    index              = \"alert-history\"\n",{"type":45,"tag":258,"props":1935,"children":1937},{"class":260,"line":1936},33,[1938],{"type":45,"tag":258,"props":1939,"children":1940},{},[1941],{"type":50,"value":1942},"    executionTimeField = \"@timestamp\"\n",{"type":45,"tag":258,"props":1944,"children":1946},{"class":260,"line":1945},34,[1947],{"type":45,"tag":258,"props":1948,"children":1949},{},[1950],{"type":50,"value":1864},{"type":45,"tag":258,"props":1952,"children":1954},{"class":260,"line":1953},35,[1955],{"type":45,"tag":258,"props":1956,"children":1957},{"emptyLinePlaceholder":1212},[1958],{"type":50,"value":1215},{"type":45,"tag":258,"props":1960,"children":1962},{"class":260,"line":1961},36,[1963],{"type":45,"tag":258,"props":1964,"children":1965},{},[1966],{"type":50,"value":1967},"  secrets = jsonencode({})\n",{"type":45,"tag":258,"props":1969,"children":1971},{"class":260,"line":1970},37,[1972],{"type":45,"tag":258,"props":1973,"children":1974},{},[1975],{"type":50,"value":1724},{"type":45,"tag":60,"props":1977,"children":1978},{},[1979],{"type":45,"tag":66,"props":1980,"children":1981},{},[1982],{"type":50,"value":1983},"Key Terraform notes:",{"type":45,"tag":1985,"props":1986,"children":1987},"ul",{},[1988,2012,2017,2038],{"type":45,"tag":1989,"props":1990,"children":1991},"li",{},[1992,1997,1999,2004,2006],{"type":45,"tag":238,"props":1993,"children":1995},{"className":1994},[],[1996],{"type":50,"value":618},{"type":50,"value":1998}," and ",{"type":45,"tag":238,"props":2000,"children":2002},{"className":2001},[],[2003],{"type":50,"value":640},{"type":50,"value":2005}," must be JSON-encoded strings via ",{"type":45,"tag":238,"props":2007,"children":2009},{"className":2008},[],[2010],{"type":50,"value":2011},"jsonencode()",{"type":45,"tag":1989,"props":2013,"children":2014},{},[2015],{"type":50,"value":2016},"Secrets are stored in Terraform state; use a remote backend with encryption and restrict state file access",{"type":45,"tag":1989,"props":2018,"children":2019},{},[2020,2022,2028,2030,2036],{"type":50,"value":2021},"Import existing connectors:\n",{"type":45,"tag":238,"props":2023,"children":2025},{"className":2024},[],[2026],{"type":50,"value":2027},"terraform import elasticstack_kibana_action_connector.my_connector \u003Cspace_id>\u002F\u003Cconnector_id>",{"type":50,"value":2029}," (use ",{"type":45,"tag":238,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":50,"value":2035},"default",{"type":50,"value":2037}," for the\ndefault space)",{"type":45,"tag":1989,"props":2039,"children":2040},{},[2041],{"type":50,"value":2042},"After import, secrets are not populated in state; you must supply them in config",{"type":45,"tag":53,"props":2044,"children":2046},{"id":2045},"preconfigured-connectors-on-prem",[2047],{"type":50,"value":2048},"Preconfigured Connectors (On-Prem)",{"type":45,"tag":60,"props":2050,"children":2051},{},[2052,2054,2060],{"type":50,"value":2053},"For self-managed Kibana, connectors can be preconfigured in ",{"type":45,"tag":238,"props":2055,"children":2057},{"className":2056},[],[2058],{"type":50,"value":2059},"kibana.yml",{"type":50,"value":2061}," so they are available at startup without manual\ncreation:",{"type":45,"tag":247,"props":2063,"children":2067},{"className":2064,"code":2065,"language":2066,"meta":252,"style":252},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","xpack.actions.preconfigured:\n  my-slack-connector:\n    name: \"Production Slack\"\n    actionTypeId: .slack\n    secrets:\n      webhookUrl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX\"\n  my-webhook:\n    name: \"Custom Webhook\"\n    actionTypeId: .webhook\n    config:\n      url: \"https:\u002F\u002Fapi.example.com\u002Falerts\"\n      method: post\n      hasAuth: true\n    secrets:\n      user: \"alert-user\"\n      password: \"secret-password\"\n","yaml",[2068],{"type":45,"tag":238,"props":2069,"children":2070},{"__ignoreMap":252},[2071,2085,2097,2123,2140,2152,2177,2189,2213,2229,2241,2266,2283,2301,2312,2337],{"type":45,"tag":258,"props":2072,"children":2073},{"class":260,"line":261},[2074,2080],{"type":45,"tag":258,"props":2075,"children":2077},{"style":2076},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[2078],{"type":50,"value":2079},"xpack.actions.preconfigured",{"type":45,"tag":258,"props":2081,"children":2082},{"style":687},[2083],{"type":50,"value":2084},":\n",{"type":45,"tag":258,"props":2086,"children":2087},{"class":260,"line":709},[2088,2093],{"type":45,"tag":258,"props":2089,"children":2090},{"style":2076},[2091],{"type":50,"value":2092},"  my-slack-connector",{"type":45,"tag":258,"props":2094,"children":2095},{"style":687},[2096],{"type":50,"value":2084},{"type":45,"tag":258,"props":2098,"children":2099},{"class":260,"line":735},[2100,2105,2110,2114,2119],{"type":45,"tag":258,"props":2101,"children":2102},{"style":2076},[2103],{"type":50,"value":2104},"    name",{"type":45,"tag":258,"props":2106,"children":2107},{"style":687},[2108],{"type":50,"value":2109},":",{"type":45,"tag":258,"props":2111,"children":2112},{"style":687},[2113],{"type":50,"value":690},{"type":45,"tag":258,"props":2115,"children":2116},{"style":676},[2117],{"type":50,"value":2118},"Production Slack",{"type":45,"tag":258,"props":2120,"children":2121},{"style":687},[2122],{"type":50,"value":1206},{"type":45,"tag":258,"props":2124,"children":2125},{"class":260,"line":760},[2126,2131,2135],{"type":45,"tag":258,"props":2127,"children":2128},{"style":2076},[2129],{"type":50,"value":2130},"    actionTypeId",{"type":45,"tag":258,"props":2132,"children":2133},{"style":687},[2134],{"type":50,"value":2109},{"type":45,"tag":258,"props":2136,"children":2137},{"style":676},[2138],{"type":50,"value":2139}," .slack\n",{"type":45,"tag":258,"props":2141,"children":2142},{"class":260,"line":785},[2143,2148],{"type":45,"tag":258,"props":2144,"children":2145},{"style":2076},[2146],{"type":50,"value":2147},"    secrets",{"type":45,"tag":258,"props":2149,"children":2150},{"style":687},[2151],{"type":50,"value":2084},{"type":45,"tag":258,"props":2153,"children":2154},{"class":260,"line":804},[2155,2160,2164,2168,2173],{"type":45,"tag":258,"props":2156,"children":2157},{"style":2076},[2158],{"type":50,"value":2159},"      webhookUrl",{"type":45,"tag":258,"props":2161,"children":2162},{"style":687},[2163],{"type":50,"value":2109},{"type":45,"tag":258,"props":2165,"children":2166},{"style":687},[2167],{"type":50,"value":690},{"type":45,"tag":258,"props":2169,"children":2170},{"style":676},[2171],{"type":50,"value":2172},"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FT00\u002FB00\u002FXXXX",{"type":45,"tag":258,"props":2174,"children":2175},{"style":687},[2176],{"type":50,"value":1206},{"type":45,"tag":258,"props":2178,"children":2179},{"class":260,"line":813},[2180,2185],{"type":45,"tag":258,"props":2181,"children":2182},{"style":2076},[2183],{"type":50,"value":2184},"  my-webhook",{"type":45,"tag":258,"props":2186,"children":2187},{"style":687},[2188],{"type":50,"value":2084},{"type":45,"tag":258,"props":2190,"children":2191},{"class":260,"line":822},[2192,2196,2200,2204,2209],{"type":45,"tag":258,"props":2193,"children":2194},{"style":2076},[2195],{"type":50,"value":2104},{"type":45,"tag":258,"props":2197,"children":2198},{"style":687},[2199],{"type":50,"value":2109},{"type":45,"tag":258,"props":2201,"children":2202},{"style":687},[2203],{"type":50,"value":690},{"type":45,"tag":258,"props":2205,"children":2206},{"style":676},[2207],{"type":50,"value":2208},"Custom Webhook",{"type":45,"tag":258,"props":2210,"children":2211},{"style":687},[2212],{"type":50,"value":1206},{"type":45,"tag":258,"props":2214,"children":2215},{"class":260,"line":831},[2216,2220,2224],{"type":45,"tag":258,"props":2217,"children":2218},{"style":2076},[2219],{"type":50,"value":2130},{"type":45,"tag":258,"props":2221,"children":2222},{"style":687},[2223],{"type":50,"value":2109},{"type":45,"tag":258,"props":2225,"children":2226},{"style":676},[2227],{"type":50,"value":2228}," .webhook\n",{"type":45,"tag":258,"props":2230,"children":2231},{"class":260,"line":840},[2232,2237],{"type":45,"tag":258,"props":2233,"children":2234},{"style":2076},[2235],{"type":50,"value":2236},"    config",{"type":45,"tag":258,"props":2238,"children":2239},{"style":687},[2240],{"type":50,"value":2084},{"type":45,"tag":258,"props":2242,"children":2243},{"class":260,"line":849},[2244,2249,2253,2257,2262],{"type":45,"tag":258,"props":2245,"children":2246},{"style":2076},[2247],{"type":50,"value":2248},"      url",{"type":45,"tag":258,"props":2250,"children":2251},{"style":687},[2252],{"type":50,"value":2109},{"type":45,"tag":258,"props":2254,"children":2255},{"style":687},[2256],{"type":50,"value":690},{"type":45,"tag":258,"props":2258,"children":2259},{"style":676},[2260],{"type":50,"value":2261},"https:\u002F\u002Fapi.example.com\u002Falerts",{"type":45,"tag":258,"props":2263,"children":2264},{"style":687},[2265],{"type":50,"value":1206},{"type":45,"tag":258,"props":2267,"children":2268},{"class":260,"line":858},[2269,2274,2278],{"type":45,"tag":258,"props":2270,"children":2271},{"style":2076},[2272],{"type":50,"value":2273},"      method",{"type":45,"tag":258,"props":2275,"children":2276},{"style":687},[2277],{"type":50,"value":2109},{"type":45,"tag":258,"props":2279,"children":2280},{"style":676},[2281],{"type":50,"value":2282}," post\n",{"type":45,"tag":258,"props":2284,"children":2285},{"class":260,"line":1090},[2286,2291,2295],{"type":45,"tag":258,"props":2287,"children":2288},{"style":2076},[2289],{"type":50,"value":2290},"      hasAuth",{"type":45,"tag":258,"props":2292,"children":2293},{"style":687},[2294],{"type":50,"value":2109},{"type":45,"tag":258,"props":2296,"children":2298},{"style":2297},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[2299],{"type":50,"value":2300}," true\n",{"type":45,"tag":258,"props":2302,"children":2303},{"class":260,"line":1098},[2304,2308],{"type":45,"tag":258,"props":2305,"children":2306},{"style":2076},[2307],{"type":50,"value":2147},{"type":45,"tag":258,"props":2309,"children":2310},{"style":687},[2311],{"type":50,"value":2084},{"type":45,"tag":258,"props":2313,"children":2314},{"class":260,"line":1780},[2315,2320,2324,2328,2333],{"type":45,"tag":258,"props":2316,"children":2317},{"style":2076},[2318],{"type":50,"value":2319},"      user",{"type":45,"tag":258,"props":2321,"children":2322},{"style":687},[2323],{"type":50,"value":2109},{"type":45,"tag":258,"props":2325,"children":2326},{"style":687},[2327],{"type":50,"value":690},{"type":45,"tag":258,"props":2329,"children":2330},{"style":676},[2331],{"type":50,"value":2332},"alert-user",{"type":45,"tag":258,"props":2334,"children":2335},{"style":687},[2336],{"type":50,"value":1206},{"type":45,"tag":258,"props":2338,"children":2339},{"class":260,"line":1788},[2340,2345,2349,2353,2358],{"type":45,"tag":258,"props":2341,"children":2342},{"style":2076},[2343],{"type":50,"value":2344},"      password",{"type":45,"tag":258,"props":2346,"children":2347},{"style":687},[2348],{"type":50,"value":2109},{"type":45,"tag":258,"props":2350,"children":2351},{"style":687},[2352],{"type":50,"value":690},{"type":45,"tag":258,"props":2354,"children":2355},{"style":676},[2356],{"type":50,"value":2357},"secret-password",{"type":45,"tag":258,"props":2359,"children":2360},{"style":687},[2361],{"type":50,"value":1206},{"type":45,"tag":60,"props":2363,"children":2364},{},[2365,2367,2373,2375,2380,2381,2387],{"type":50,"value":2366},"Preconfigured connectors cannot be edited or deleted via the API or UI. They show ",{"type":45,"tag":238,"props":2368,"children":2370},{"className":2369},[],[2371],{"type":50,"value":2372},"is_preconfigured: true",{"type":50,"value":2374}," and omit\n",{"type":45,"tag":238,"props":2376,"children":2378},{"className":2377},[],[2379],{"type":50,"value":618},{"type":50,"value":1998},{"type":45,"tag":238,"props":2382,"children":2384},{"className":2383},[],[2385],{"type":50,"value":2386},"is_missing_secrets",{"type":50,"value":2388}," from API responses.",{"type":45,"tag":53,"props":2390,"children":2392},{"id":2391},"networking-configuration",[2393],{"type":50,"value":2394},"Networking Configuration",{"type":45,"tag":60,"props":2396,"children":2397},{},[2398,2400,2405],{"type":50,"value":2399},"Customize connector networking (proxies, TLS, certificates) via ",{"type":45,"tag":238,"props":2401,"children":2403},{"className":2402},[],[2404],{"type":50,"value":2059},{"type":50,"value":2109},{"type":45,"tag":247,"props":2407,"children":2409},{"className":2064,"code":2408,"language":2066,"meta":252,"style":252},"# Global proxy for all connectors\nxpack.actions.proxyUrl: \"https:\u002F\u002Fproxy.example.com:8443\"\n\n# Per-host TLS settings\nxpack.actions.customHostSettings:\n  - url: \"https:\u002F\u002Fapi.example.com\"\n    ssl:\n      verificationMode: full\n      certificateAuthoritiesFiles: [\"\u002Fpath\u002Fto\u002Fca.pem\"]\n",[2410],{"type":45,"tag":238,"props":2411,"children":2412},{"__ignoreMap":252},[2413,2421,2446,2453,2461,2473,2503,2515,2532],{"type":45,"tag":258,"props":2414,"children":2415},{"class":260,"line":261},[2416],{"type":45,"tag":258,"props":2417,"children":2418},{"style":1150},[2419],{"type":50,"value":2420},"# Global proxy for all connectors\n",{"type":45,"tag":258,"props":2422,"children":2423},{"class":260,"line":709},[2424,2429,2433,2437,2442],{"type":45,"tag":258,"props":2425,"children":2426},{"style":2076},[2427],{"type":50,"value":2428},"xpack.actions.proxyUrl",{"type":45,"tag":258,"props":2430,"children":2431},{"style":687},[2432],{"type":50,"value":2109},{"type":45,"tag":258,"props":2434,"children":2435},{"style":687},[2436],{"type":50,"value":690},{"type":45,"tag":258,"props":2438,"children":2439},{"style":676},[2440],{"type":50,"value":2441},"https:\u002F\u002Fproxy.example.com:8443",{"type":45,"tag":258,"props":2443,"children":2444},{"style":687},[2445],{"type":50,"value":1206},{"type":45,"tag":258,"props":2447,"children":2448},{"class":260,"line":735},[2449],{"type":45,"tag":258,"props":2450,"children":2451},{"emptyLinePlaceholder":1212},[2452],{"type":50,"value":1215},{"type":45,"tag":258,"props":2454,"children":2455},{"class":260,"line":760},[2456],{"type":45,"tag":258,"props":2457,"children":2458},{"style":1150},[2459],{"type":50,"value":2460},"# Per-host TLS settings\n",{"type":45,"tag":258,"props":2462,"children":2463},{"class":260,"line":785},[2464,2469],{"type":45,"tag":258,"props":2465,"children":2466},{"style":2076},[2467],{"type":50,"value":2468},"xpack.actions.customHostSettings",{"type":45,"tag":258,"props":2470,"children":2471},{"style":687},[2472],{"type":50,"value":2084},{"type":45,"tag":258,"props":2474,"children":2475},{"class":260,"line":804},[2476,2481,2486,2490,2494,2499],{"type":45,"tag":258,"props":2477,"children":2478},{"style":687},[2479],{"type":50,"value":2480},"  -",{"type":45,"tag":258,"props":2482,"children":2483},{"style":2076},[2484],{"type":50,"value":2485}," url",{"type":45,"tag":258,"props":2487,"children":2488},{"style":687},[2489],{"type":50,"value":2109},{"type":45,"tag":258,"props":2491,"children":2492},{"style":687},[2493],{"type":50,"value":690},{"type":45,"tag":258,"props":2495,"children":2496},{"style":676},[2497],{"type":50,"value":2498},"https:\u002F\u002Fapi.example.com",{"type":45,"tag":258,"props":2500,"children":2501},{"style":687},[2502],{"type":50,"value":1206},{"type":45,"tag":258,"props":2504,"children":2505},{"class":260,"line":813},[2506,2511],{"type":45,"tag":258,"props":2507,"children":2508},{"style":2076},[2509],{"type":50,"value":2510},"    ssl",{"type":45,"tag":258,"props":2512,"children":2513},{"style":687},[2514],{"type":50,"value":2084},{"type":45,"tag":258,"props":2516,"children":2517},{"class":260,"line":822},[2518,2523,2527],{"type":45,"tag":258,"props":2519,"children":2520},{"style":2076},[2521],{"type":50,"value":2522},"      verificationMode",{"type":45,"tag":258,"props":2524,"children":2525},{"style":687},[2526],{"type":50,"value":2109},{"type":45,"tag":258,"props":2528,"children":2529},{"style":676},[2530],{"type":50,"value":2531}," full\n",{"type":45,"tag":258,"props":2533,"children":2534},{"class":260,"line":831},[2535,2540,2544,2549,2553,2558,2562],{"type":45,"tag":258,"props":2536,"children":2537},{"style":2076},[2538],{"type":50,"value":2539},"      certificateAuthoritiesFiles",{"type":45,"tag":258,"props":2541,"children":2542},{"style":687},[2543],{"type":50,"value":2109},{"type":45,"tag":258,"props":2545,"children":2546},{"style":687},[2547],{"type":50,"value":2548}," [",{"type":45,"tag":258,"props":2550,"children":2551},{"style":687},[2552],{"type":50,"value":700},{"type":45,"tag":258,"props":2554,"children":2555},{"style":676},[2556],{"type":50,"value":2557},"\u002Fpath\u002Fto\u002Fca.pem",{"type":45,"tag":258,"props":2559,"children":2560},{"style":687},[2561],{"type":50,"value":700},{"type":45,"tag":258,"props":2563,"children":2564},{"style":687},[2565],{"type":50,"value":2566},"]\n",{"type":45,"tag":53,"props":2568,"children":2570},{"id":2569},"connectors-in-kibana-workflows",[2571],{"type":50,"value":2572},"Connectors in Kibana Workflows",{"type":45,"tag":60,"props":2574,"children":2575},{},[2576],{"type":50,"value":2577},"Connectors serve as the integration layer across multiple Kibana workflows, not just alerting notifications:",{"type":45,"tag":88,"props":2579,"children":2580},{},[2581,2601],{"type":45,"tag":92,"props":2582,"children":2583},{},[2584],{"type":45,"tag":96,"props":2585,"children":2586},{},[2587,2592,2596],{"type":45,"tag":100,"props":2588,"children":2589},{},[2590],{"type":50,"value":2591},"Workflow",{"type":45,"tag":100,"props":2593,"children":2594},{},[2595],{"type":50,"value":109},{"type":45,"tag":100,"props":2597,"children":2598},{},[2599],{"type":50,"value":2600},"Key Pattern",{"type":45,"tag":111,"props":2602,"children":2603},{},[2604,2631,2673,2694,2721,2748,2769],{"type":45,"tag":96,"props":2605,"children":2606},{},[2607,2615,2620],{"type":45,"tag":118,"props":2608,"children":2609},{},[2610],{"type":45,"tag":66,"props":2611,"children":2612},{},[2613],{"type":50,"value":2614},"ITSM ticketing",{"type":45,"tag":118,"props":2616,"children":2617},{},[2618],{"type":50,"value":2619},"ServiceNow, Jira, IBM Resilient",{"type":45,"tag":118,"props":2621,"children":2622},{},[2623,2625],{"type":50,"value":2624},"Create ticket on active, close on ",{"type":45,"tag":238,"props":2626,"children":2628},{"className":2627},[],[2629],{"type":50,"value":2630},"Recovered",{"type":45,"tag":96,"props":2632,"children":2633},{},[2634,2642,2647],{"type":45,"tag":118,"props":2635,"children":2636},{},[2637],{"type":45,"tag":66,"props":2638,"children":2639},{},[2640],{"type":50,"value":2641},"On-call escalation",{"type":45,"tag":118,"props":2643,"children":2644},{},[2645],{"type":50,"value":2646},"PagerDuty, Opsgenie",{"type":45,"tag":118,"props":2648,"children":2649},{},[2650,2656,2658,2664,2666,2671],{"type":45,"tag":238,"props":2651,"children":2653},{"className":2652},[],[2654],{"type":50,"value":2655},"trigger",{"type":50,"value":2657}," on active, ",{"type":45,"tag":238,"props":2659,"children":2661},{"className":2660},[],[2662],{"type":50,"value":2663},"resolve",{"type":50,"value":2665}," on ",{"type":45,"tag":238,"props":2667,"children":2669},{"className":2668},[],[2670],{"type":50,"value":2630},{"type":50,"value":2672},"; always set a deduplication key",{"type":45,"tag":96,"props":2674,"children":2675},{},[2676,2684,2689],{"type":45,"tag":118,"props":2677,"children":2678},{},[2679],{"type":45,"tag":66,"props":2680,"children":2681},{},[2682],{"type":50,"value":2683},"Case management",{"type":45,"tag":118,"props":2685,"children":2686},{},[2687],{"type":50,"value":2688},"Cases (system action)",{"type":45,"tag":118,"props":2690,"children":2691},{},[2692],{"type":50,"value":2693},"UI-only; groups alerts into investigation Cases; can auto-push to ITSM",{"type":45,"tag":96,"props":2695,"children":2696},{},[2697,2705,2710],{"type":45,"tag":118,"props":2698,"children":2699},{},[2700],{"type":45,"tag":66,"props":2701,"children":2702},{},[2703],{"type":50,"value":2704},"Messaging \u002F awareness",{"type":45,"tag":118,"props":2706,"children":2707},{},[2708],{"type":50,"value":2709},"Slack, Teams, Email",{"type":45,"tag":118,"props":2711,"children":2712},{},[2713,2719],{"type":45,"tag":238,"props":2714,"children":2716},{"className":2715},[],[2717],{"type":50,"value":2718},"onActionGroupChange",{"type":50,"value":2720}," for incident channels; summaries for monitoring channels",{"type":45,"tag":96,"props":2722,"children":2723},{},[2724,2732,2737],{"type":45,"tag":118,"props":2725,"children":2726},{},[2727],{"type":45,"tag":66,"props":2728,"children":2729},{},[2730],{"type":50,"value":2731},"Audit logging",{"type":45,"tag":118,"props":2733,"children":2734},{},[2735],{"type":50,"value":2736},"Index",{"type":45,"tag":118,"props":2738,"children":2739},{},[2740,2746],{"type":45,"tag":238,"props":2741,"children":2743},{"className":2742},[],[2744],{"type":50,"value":2745},"onActiveAlert",{"type":50,"value":2747}," to write full alert time-series to Elasticsearch",{"type":45,"tag":96,"props":2749,"children":2750},{},[2751,2759,2764],{"type":45,"tag":118,"props":2752,"children":2753},{},[2754],{"type":45,"tag":66,"props":2755,"children":2756},{},[2757],{"type":50,"value":2758},"AI workflows",{"type":45,"tag":118,"props":2760,"children":2761},{},[2762],{"type":50,"value":2763},"OpenAI, Bedrock, Gemini, AI Connector",{"type":45,"tag":118,"props":2765,"children":2766},{},[2767],{"type":50,"value":2768},"Powers Elastic AI Assistant and Attack Discovery; system-managed",{"type":45,"tag":96,"props":2770,"children":2771},{},[2772,2780,2784],{"type":45,"tag":118,"props":2773,"children":2774},{},[2775],{"type":45,"tag":66,"props":2776,"children":2777},{},[2778],{"type":50,"value":2779},"Custom integrations",{"type":45,"tag":118,"props":2781,"children":2782},{},[2783],{"type":50,"value":205},{"type":45,"tag":118,"props":2785,"children":2786},{},[2787],{"type":50,"value":2788},"Generic HTTP outbound with Mustache-templated JSON body",{"type":45,"tag":60,"props":2790,"children":2791},{},[2792,2794,2800],{"type":50,"value":2793},"For detailed patterns, examples, and decision guidance for each workflow, see ",{"type":45,"tag":896,"props":2795,"children":2797},{"href":2796},"references\u002Fworkflows.md",[2798],{"type":50,"value":2799},"workflows.md",{"type":50,"value":1660},{"type":45,"tag":53,"props":2802,"children":2804},{"id":2803},"best-practices",[2805],{"type":50,"value":2806},"Best Practices",{"type":45,"tag":2808,"props":2809,"children":2810},"ol",{},[2811,2821,2839,2856,2874,2892,2902,2912,2940,2950,2984,2994,3004],{"type":45,"tag":1989,"props":2812,"children":2813},{},[2814,2819],{"type":45,"tag":66,"props":2815,"children":2816},{},[2817],{"type":50,"value":2818},"Use preconfigured connectors for production on-prem.",{"type":50,"value":2820}," They eliminate secret sprawl, survive Saved Object imports,\nand cannot be accidentally deleted. Reserve API-created connectors for dynamic or user-managed scenarios.",{"type":45,"tag":1989,"props":2822,"children":2823},{},[2824,2829,2831,2837],{"type":45,"tag":66,"props":2825,"children":2826},{},[2827],{"type":50,"value":2828},"Test connectors before attaching to rules.",{"type":50,"value":2830}," Use the ",{"type":45,"tag":238,"props":2832,"children":2834},{"className":2833},[],[2835],{"type":50,"value":2836},"_execute",{"type":50,"value":2838}," endpoint to verify connectivity. A misconfigured\nconnector causes silent action failures that only appear in the rule's execution history.",{"type":45,"tag":1989,"props":2840,"children":2841},{},[2842,2854],{"type":45,"tag":66,"props":2843,"children":2844},{},[2845,2847,2852],{"type":50,"value":2846},"Check ",{"type":45,"tag":238,"props":2848,"children":2850},{"className":2849},[],[2851],{"type":50,"value":1359},{"type":50,"value":2853}," before deleting.",{"type":50,"value":2855}," Deleting a connector used by active rules causes those actions to\nfail. List connectors and verify zero references, or reassign rules to a new connector first.",{"type":45,"tag":1989,"props":2857,"children":2858},{},[2859,2864,2866,2872],{"type":45,"tag":66,"props":2860,"children":2861},{},[2862],{"type":50,"value":2863},"Use the Email domain allowlist.",{"type":50,"value":2865}," The ",{"type":45,"tag":238,"props":2867,"children":2869},{"className":2868},[],[2870],{"type":50,"value":2871},"xpack.actions.email.domain_allowlist",{"type":50,"value":2873}," setting restricts which email domains\nconnectors can send to. If you update this list, existing email connectors with recipients outside the new list will\nstart failing.",{"type":45,"tag":1989,"props":2875,"children":2876},{},[2877,2882,2884,2890],{"type":45,"tag":66,"props":2878,"children":2879},{},[2880],{"type":50,"value":2881},"Secure secrets in Terraform.",{"type":50,"value":2883}," Connector secrets (API keys, passwords, webhook URLs) are stored in Terraform state.\nUse encrypted remote backends (S3+KMS, Azure Blob+encryption, GCS+CMEK) and restrict access to state files. Use\n",{"type":45,"tag":238,"props":2885,"children":2887},{"className":2886},[],[2888],{"type":50,"value":2889},"sensitive = true",{"type":50,"value":2891}," on variables.",{"type":45,"tag":1989,"props":2893,"children":2894},{},[2895,2900],{"type":45,"tag":66,"props":2896,"children":2897},{},[2898],{"type":50,"value":2899},"One connector per service, not per rule.",{"type":50,"value":2901}," Create a single Slack connector and reference it from multiple rules.\nThis centralizes secret rotation and reduces duplication.",{"type":45,"tag":1989,"props":2903,"children":2904},{},[2905,2910],{"type":45,"tag":66,"props":2906,"children":2907},{},[2908],{"type":50,"value":2909},"Use Spaces for multi-tenant isolation.",{"type":50,"value":2911}," Connectors are scoped to a Kibana Space. Create separate spaces for\ndifferent teams or environments and configure connectors per space.",{"type":45,"tag":1989,"props":2913,"children":2914},{},[2915,2920,2922,2928,2930,2938],{"type":45,"tag":66,"props":2916,"children":2917},{},[2918],{"type":50,"value":2919},"Monitor connector health.",{"type":50,"value":2921}," Failed connector executions are logged in the event log index (",{"type":45,"tag":238,"props":2923,"children":2925},{"className":2924},[],[2926],{"type":50,"value":2927},".kibana-event-log-*",{"type":50,"value":2929},").\nConnector failures report as successful to Task Manager but fail silently for alert delivery. Check the\n",{"type":45,"tag":896,"props":2931,"children":2935},{"href":2932,"rel":2933},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts\u002Fevent-log-index",[2934],"nofollow",[2936],{"type":50,"value":2937},"Event Log Index",{"type":50,"value":2939}," for true failure\nrates.",{"type":45,"tag":1989,"props":2941,"children":2942},{},[2943,2948],{"type":45,"tag":66,"props":2944,"children":2945},{},[2946],{"type":50,"value":2947},"Always configure a recovery action alongside the active action.",{"type":50,"value":2949}," Connectors for ITSM and on-call tools\n(ServiceNow, Jira, PagerDuty, Opsgenie) support a close\u002Fresolve operation. Without a recovery action, incidents\nremain open forever.",{"type":45,"tag":1989,"props":2951,"children":2952},{},[2953,2958,2960,2966,2968,2974,2976,2982],{"type":45,"tag":66,"props":2954,"children":2955},{},[2956],{"type":50,"value":2957},"Use deduplication keys for on-call connectors.",{"type":50,"value":2959}," Set ",{"type":45,"tag":238,"props":2961,"children":2963},{"className":2962},[],[2964],{"type":50,"value":2965},"dedupKey",{"type":50,"value":2967}," (PagerDuty) or ",{"type":45,"tag":238,"props":2969,"children":2971},{"className":2970},[],[2972],{"type":50,"value":2973},"alias",{"type":50,"value":2975}," (Opsgenie) to\n",{"type":45,"tag":238,"props":2977,"children":2979},{"className":2978},[],[2980],{"type":50,"value":2981},"{{rule.id}}-{{alert.id}}",{"type":50,"value":2983}," to ensure the resolve event closes exactly the right incident. Without this, a new\nincident is created every time the alert re-fires.",{"type":45,"tag":1989,"props":2985,"children":2986},{},[2987,2992],{"type":45,"tag":66,"props":2988,"children":2989},{},[2990],{"type":50,"value":2991},"Prefer the Cases connector for investigation workflows.",{"type":50,"value":2993}," When an alert requires investigation with comments,\nattachments, and assignees, use Cases rather than a direct Jira\u002FServiceNow connector. Cases gives you a native\ninvestigation UI and can still push to ITSM via the Case's external connection.",{"type":45,"tag":1989,"props":2995,"children":2996},{},[2997,3002],{"type":45,"tag":66,"props":2998,"children":2999},{},[3000],{"type":50,"value":3001},"Use the Index connector for durable audit trails.",{"type":50,"value":3003}," The Index connector writes to Elasticsearch, making alert\nhistory searchable and dashboardable. Pair it with an ILM policy on the target index to control retention.",{"type":45,"tag":1989,"props":3005,"children":3006},{},[3007,3012,3014,3020,3022,3028],{"type":45,"tag":66,"props":3008,"children":3009},{},[3010],{"type":50,"value":3011},"Restrict connector access via Action settings.",{"type":50,"value":3013}," Use ",{"type":45,"tag":238,"props":3015,"children":3017},{"className":3016},[],[3018],{"type":50,"value":3019},"xpack.actions.enabledActionTypes",{"type":50,"value":3021}," to allowlist only the\nconnector types your organization needs, and ",{"type":45,"tag":238,"props":3023,"children":3025},{"className":3024},[],[3026],{"type":50,"value":3027},"xpack.actions.allowedHosts",{"type":50,"value":3029}," to restrict outbound connections to known\nendpoints.",{"type":45,"tag":53,"props":3031,"children":3033},{"id":3032},"common-pitfalls",[3034],{"type":50,"value":3035},"Common Pitfalls",{"type":45,"tag":2808,"props":3037,"children":3038},{},[3039,3062,3099,3139,3156,3174,3190,3200,3217,3258],{"type":45,"tag":1989,"props":3040,"children":3041},{},[3042,3053,3055,3060],{"type":45,"tag":66,"props":3043,"children":3044},{},[3045,3047,3052],{"type":50,"value":3046},"Missing ",{"type":45,"tag":238,"props":3048,"children":3050},{"className":3049},[],[3051],{"type":50,"value":243},{"type":50,"value":245},{"type":50,"value":3054}," All POST, PUT, DELETE requests require ",{"type":45,"tag":238,"props":3056,"children":3058},{"className":3057},[],[3059],{"type":50,"value":724},{"type":50,"value":3061},". Omitting it returns a 400\nerror.",{"type":45,"tag":1989,"props":3063,"children":3064},{},[3065,3076,3078,3083,3085,3090,3092,3098],{"type":45,"tag":66,"props":3066,"children":3067},{},[3068,3070,3075],{"type":50,"value":3069},"Wrong ",{"type":45,"tag":238,"props":3071,"children":3073},{"className":3072},[],[3074],{"type":50,"value":560},{"type":50,"value":1660},{"type":50,"value":3077}," Use the exact string including the leading dot (e.g., ",{"type":45,"tag":238,"props":3079,"children":3081},{"className":3080},[],[3082],{"type":50,"value":575},{"type":50,"value":3084},", not ",{"type":45,"tag":238,"props":3086,"children":3088},{"className":3087},[],[3089],{"type":50,"value":25},{"type":50,"value":3091},"). Discover\nvalid types via ",{"type":45,"tag":238,"props":3093,"children":3095},{"className":3094},[],[3096],{"type":50,"value":3097},"GET \u002Fapi\u002Factions\u002Fconnector_types",{"type":50,"value":1660},{"type":45,"tag":1989,"props":3100,"children":3101},{},[3102,3114,3116,3122,3123,3129,3131,3137],{"type":45,"tag":66,"props":3103,"children":3104},{},[3105,3107,3112],{"type":50,"value":3106},"Empty ",{"type":45,"tag":238,"props":3108,"children":3110},{"className":3109},[],[3111],{"type":50,"value":640},{"type":50,"value":3113}," object required.",{"type":50,"value":3115}," Even for connectors without secrets (e.g., ",{"type":45,"tag":238,"props":3117,"children":3119},{"className":3118},[],[3120],{"type":50,"value":3121},".index",{"type":50,"value":577},{"type":45,"tag":238,"props":3124,"children":3126},{"className":3125},[],[3127],{"type":50,"value":3128},".server-log",{"type":50,"value":3130},"), you must\nprovide ",{"type":45,"tag":238,"props":3132,"children":3134},{"className":3133},[],[3135],{"type":50,"value":3136},"\"secrets\": {}",{"type":50,"value":3138}," in the create request.",{"type":45,"tag":1989,"props":3140,"children":3141},{},[3142,3147,3149,3154],{"type":45,"tag":66,"props":3143,"children":3144},{},[3145],{"type":50,"value":3146},"Connector type is immutable.",{"type":50,"value":3148}," You cannot change the ",{"type":45,"tag":238,"props":3150,"children":3152},{"className":3151},[],[3153],{"type":50,"value":560},{"type":50,"value":3155}," after creation. Delete and recreate\ninstead.",{"type":45,"tag":1989,"props":3157,"children":3158},{},[3159,3164,3166,3172],{"type":45,"tag":66,"props":3160,"children":3161},{},[3162],{"type":50,"value":3163},"Secrets lost on export\u002Fimport.",{"type":50,"value":3165}," Exporting connectors via Saved Objects strips secrets. After import, connectors\nshow ",{"type":45,"tag":238,"props":3167,"children":3169},{"className":3168},[],[3170],{"type":50,"value":3171},"is_missing_secrets: true",{"type":50,"value":3173}," and a \"Fix\" button appears in the UI. You must re-enter secrets manually or via API.",{"type":45,"tag":1989,"props":3175,"children":3176},{},[3177,3182,3184,3189],{"type":45,"tag":66,"props":3178,"children":3179},{},[3180],{"type":50,"value":3181},"Preconfigured connectors cannot be modified via API.",{"type":50,"value":3183}," Attempting to update or delete a preconfigured connector\nreturns 400. Manage them exclusively in ",{"type":45,"tag":238,"props":3185,"children":3187},{"className":3186},[],[3188],{"type":50,"value":2059},{"type":50,"value":1660},{"type":45,"tag":1989,"props":3191,"children":3192},{},[3193,3198],{"type":45,"tag":66,"props":3194,"children":3195},{},[3196],{"type":50,"value":3197},"Rate limits from third-party services.",{"type":50,"value":3199}," Connectors that send high volumes of notifications (e.g., one per alert\nevery minute) can hit Slack, PagerDuty, or email provider rate limits. Use alert summaries and action frequency\ncontrols on the rule side to reduce volume.",{"type":45,"tag":1989,"props":3201,"children":3202},{},[3203,3208,3210,3215],{"type":45,"tag":66,"props":3204,"children":3205},{},[3206],{"type":50,"value":3207},"Connector networking failures.",{"type":50,"value":3209}," Kibana must be able to reach the connector's target URL. Verify firewall rules,\nproxy settings, and DNS resolution. Use ",{"type":45,"tag":238,"props":3211,"children":3213},{"className":3212},[],[3214],{"type":50,"value":2468},{"type":50,"value":3216}," for TLS issues.",{"type":45,"tag":1989,"props":3218,"children":3219},{},[3220,3225,3227,3233,3235,3240,3242,3248,3250,3256],{"type":45,"tag":66,"props":3221,"children":3222},{},[3223],{"type":50,"value":3224},"License requirements.",{"type":50,"value":3226}," Some connector types require a Gold, Platinum, or Enterprise license. Check the\n",{"type":45,"tag":238,"props":3228,"children":3230},{"className":3229},[],[3231],{"type":50,"value":3232},"minimum_license_required",{"type":50,"value":3234}," field from ",{"type":45,"tag":238,"props":3236,"children":3238},{"className":3237},[],[3239],{"type":50,"value":3097},{"type":50,"value":3241},". A connector that is\n",{"type":45,"tag":238,"props":3243,"children":3245},{"className":3244},[],[3246],{"type":50,"value":3247},"enabled_in_config: true",{"type":50,"value":3249}," but ",{"type":45,"tag":238,"props":3251,"children":3253},{"className":3252},[],[3254],{"type":50,"value":3255},"enabled_in_license: false",{"type":50,"value":3257}," cannot be used.",{"type":45,"tag":1989,"props":3259,"children":3260},{},[3261,3266,3268,3274],{"type":45,"tag":66,"props":3262,"children":3263},{},[3264],{"type":50,"value":3265},"Terraform import does not restore secrets.",{"type":50,"value":3267}," When importing an existing connector into Terraform, the secrets are\nnot read back from Kibana. You must provide them in your Terraform configuration, or the next ",{"type":45,"tag":238,"props":3269,"children":3271},{"className":3270},[],[3272],{"type":50,"value":3273},"terraform apply",{"type":50,"value":3275}," will\noverwrite them with empty values.",{"type":45,"tag":53,"props":3277,"children":3279},{"id":3278},"common-connector-type-ids",[3280],{"type":50,"value":901},{"type":45,"tag":88,"props":3282,"children":3283},{},[3284,3305],{"type":45,"tag":92,"props":3285,"children":3286},{},[3287],{"type":45,"tag":96,"props":3288,"children":3289},{},[3290,3295,3300],{"type":45,"tag":100,"props":3291,"children":3292},{},[3293],{"type":50,"value":3294},"Type ID",{"type":45,"tag":100,"props":3296,"children":3297},{},[3298],{"type":50,"value":3299},"Name",{"type":45,"tag":100,"props":3301,"children":3302},{},[3303],{"type":50,"value":3304},"License",{"type":45,"tag":111,"props":3306,"children":3307},{},[3308,3329,3349,3370,3390,3409,3431,3452,3473,3492,3512,3532,3553,3574,3596,3617,3638,3658,3679,3700,3721],{"type":45,"tag":96,"props":3309,"children":3310},{},[3311,3319,3324],{"type":45,"tag":118,"props":3312,"children":3313},{},[3314],{"type":45,"tag":238,"props":3315,"children":3317},{"className":3316},[],[3318],{"type":50,"value":583},{"type":45,"tag":118,"props":3320,"children":3321},{},[3322],{"type":50,"value":3323},"Email",{"type":45,"tag":118,"props":3325,"children":3326},{},[3327],{"type":50,"value":3328},"Gold",{"type":45,"tag":96,"props":3330,"children":3331},{},[3332,3340,3345],{"type":45,"tag":118,"props":3333,"children":3334},{},[3335],{"type":45,"tag":238,"props":3336,"children":3338},{"className":3337},[],[3339],{"type":50,"value":575},{"type":45,"tag":118,"props":3341,"children":3342},{},[3343],{"type":50,"value":3344},"Slack (Webhook)",{"type":45,"tag":118,"props":3346,"children":3347},{},[3348],{"type":50,"value":3328},{"type":45,"tag":96,"props":3350,"children":3351},{},[3352,3361,3366],{"type":45,"tag":118,"props":3353,"children":3354},{},[3355],{"type":45,"tag":238,"props":3356,"children":3358},{"className":3357},[],[3359],{"type":50,"value":3360},".slack_api",{"type":45,"tag":118,"props":3362,"children":3363},{},[3364],{"type":50,"value":3365},"Slack (API)",{"type":45,"tag":118,"props":3367,"children":3368},{},[3369],{"type":50,"value":3328},{"type":45,"tag":96,"props":3371,"children":3372},{},[3373,3381,3386],{"type":45,"tag":118,"props":3374,"children":3375},{},[3376],{"type":45,"tag":238,"props":3377,"children":3379},{"className":3378},[],[3380],{"type":50,"value":597},{"type":45,"tag":118,"props":3382,"children":3383},{},[3384],{"type":50,"value":3385},"PagerDuty",{"type":45,"tag":118,"props":3387,"children":3388},{},[3389],{"type":50,"value":3328},{"type":45,"tag":96,"props":3391,"children":3392},{},[3393,3401,3405],{"type":45,"tag":118,"props":3394,"children":3395},{},[3396],{"type":45,"tag":238,"props":3397,"children":3399},{"className":3398},[],[3400],{"type":50,"value":604},{"type":45,"tag":118,"props":3402,"children":3403},{},[3404],{"type":50,"value":13},{"type":45,"tag":118,"props":3406,"children":3407},{},[3408],{"type":50,"value":3328},{"type":45,"tag":96,"props":3410,"children":3411},{},[3412,3421,3426],{"type":45,"tag":118,"props":3413,"children":3414},{},[3415],{"type":45,"tag":238,"props":3416,"children":3418},{"className":3417},[],[3419],{"type":50,"value":3420},".servicenow",{"type":45,"tag":118,"props":3422,"children":3423},{},[3424],{"type":50,"value":3425},"ServiceNow ITSM",{"type":45,"tag":118,"props":3427,"children":3428},{},[3429],{"type":50,"value":3430},"Platinum",{"type":45,"tag":96,"props":3432,"children":3433},{},[3434,3443,3448],{"type":45,"tag":118,"props":3435,"children":3436},{},[3437],{"type":45,"tag":238,"props":3438,"children":3440},{"className":3439},[],[3441],{"type":50,"value":3442},".servicenow-sir",{"type":45,"tag":118,"props":3444,"children":3445},{},[3446],{"type":50,"value":3447},"ServiceNow SecOps",{"type":45,"tag":118,"props":3449,"children":3450},{},[3451],{"type":50,"value":3430},{"type":45,"tag":96,"props":3453,"children":3454},{},[3455,3464,3469],{"type":45,"tag":118,"props":3456,"children":3457},{},[3458],{"type":45,"tag":238,"props":3459,"children":3461},{"className":3460},[],[3462],{"type":50,"value":3463},".servicenow-itom",{"type":45,"tag":118,"props":3465,"children":3466},{},[3467],{"type":50,"value":3468},"ServiceNow ITOM",{"type":45,"tag":118,"props":3470,"children":3471},{},[3472],{"type":50,"value":3430},{"type":45,"tag":96,"props":3474,"children":3475},{},[3476,3484,3488],{"type":45,"tag":118,"props":3477,"children":3478},{},[3479],{"type":45,"tag":238,"props":3480,"children":3482},{"className":3481},[],[3483],{"type":50,"value":590},{"type":45,"tag":118,"props":3485,"children":3486},{},[3487],{"type":50,"value":205},{"type":45,"tag":118,"props":3489,"children":3490},{},[3491],{"type":50,"value":3328},{"type":45,"tag":96,"props":3493,"children":3494},{},[3495,3503,3507],{"type":45,"tag":118,"props":3496,"children":3497},{},[3498],{"type":45,"tag":238,"props":3499,"children":3501},{"className":3500},[],[3502],{"type":50,"value":3121},{"type":45,"tag":118,"props":3504,"children":3505},{},[3506],{"type":50,"value":2736},{"type":45,"tag":118,"props":3508,"children":3509},{},[3510],{"type":50,"value":3511},"Basic",{"type":45,"tag":96,"props":3513,"children":3514},{},[3515,3523,3528],{"type":45,"tag":118,"props":3516,"children":3517},{},[3518],{"type":45,"tag":238,"props":3519,"children":3521},{"className":3520},[],[3522],{"type":50,"value":3128},{"type":45,"tag":118,"props":3524,"children":3525},{},[3526],{"type":50,"value":3527},"Server log",{"type":45,"tag":118,"props":3529,"children":3530},{},[3531],{"type":50,"value":3511},{"type":45,"tag":96,"props":3533,"children":3534},{},[3535,3544,3549],{"type":45,"tag":118,"props":3536,"children":3537},{},[3538],{"type":45,"tag":238,"props":3539,"children":3541},{"className":3540},[],[3542],{"type":50,"value":3543},".opsgenie",{"type":45,"tag":118,"props":3545,"children":3546},{},[3547],{"type":50,"value":3548},"Opsgenie",{"type":45,"tag":118,"props":3550,"children":3551},{},[3552],{"type":50,"value":3328},{"type":45,"tag":96,"props":3554,"children":3555},{},[3556,3565,3570],{"type":45,"tag":118,"props":3557,"children":3558},{},[3559],{"type":45,"tag":238,"props":3560,"children":3562},{"className":3561},[],[3563],{"type":50,"value":3564},".teams",{"type":45,"tag":118,"props":3566,"children":3567},{},[3568],{"type":50,"value":3569},"Microsoft Teams",{"type":45,"tag":118,"props":3571,"children":3572},{},[3573],{"type":50,"value":3328},{"type":45,"tag":96,"props":3575,"children":3576},{},[3577,3586,3591],{"type":45,"tag":118,"props":3578,"children":3579},{},[3580],{"type":45,"tag":238,"props":3581,"children":3583},{"className":3582},[],[3584],{"type":50,"value":3585},".gen-ai",{"type":45,"tag":118,"props":3587,"children":3588},{},[3589],{"type":50,"value":3590},"OpenAI",{"type":45,"tag":118,"props":3592,"children":3593},{},[3594],{"type":50,"value":3595},"Enterprise",{"type":45,"tag":96,"props":3597,"children":3598},{},[3599,3608,3613],{"type":45,"tag":118,"props":3600,"children":3601},{},[3602],{"type":45,"tag":238,"props":3603,"children":3605},{"className":3604},[],[3606],{"type":50,"value":3607},".bedrock",{"type":45,"tag":118,"props":3609,"children":3610},{},[3611],{"type":50,"value":3612},"Amazon Bedrock",{"type":45,"tag":118,"props":3614,"children":3615},{},[3616],{"type":50,"value":3595},{"type":45,"tag":96,"props":3618,"children":3619},{},[3620,3629,3634],{"type":45,"tag":118,"props":3621,"children":3622},{},[3623],{"type":45,"tag":238,"props":3624,"children":3626},{"className":3625},[],[3627],{"type":50,"value":3628},".gemini",{"type":45,"tag":118,"props":3630,"children":3631},{},[3632],{"type":50,"value":3633},"Google Gemini",{"type":45,"tag":118,"props":3635,"children":3636},{},[3637],{"type":50,"value":3595},{"type":45,"tag":96,"props":3639,"children":3640},{},[3641,3650,3654],{"type":45,"tag":118,"props":3642,"children":3643},{},[3644],{"type":45,"tag":238,"props":3645,"children":3647},{"className":3646},[],[3648],{"type":50,"value":3649},".cases",{"type":45,"tag":118,"props":3651,"children":3652},{},[3653],{"type":50,"value":225},{"type":45,"tag":118,"props":3655,"children":3656},{},[3657],{"type":50,"value":3430},{"type":45,"tag":96,"props":3659,"children":3660},{},[3661,3670,3675],{"type":45,"tag":118,"props":3662,"children":3663},{},[3664],{"type":45,"tag":238,"props":3665,"children":3667},{"className":3666},[],[3668],{"type":50,"value":3669},".crowdstrike",{"type":45,"tag":118,"props":3671,"children":3672},{},[3673],{"type":50,"value":3674},"CrowdStrike",{"type":45,"tag":118,"props":3676,"children":3677},{},[3678],{"type":50,"value":3595},{"type":45,"tag":96,"props":3680,"children":3681},{},[3682,3691,3696],{"type":45,"tag":118,"props":3683,"children":3684},{},[3685],{"type":45,"tag":238,"props":3686,"children":3688},{"className":3687},[],[3689],{"type":50,"value":3690},".sentinelone",{"type":45,"tag":118,"props":3692,"children":3693},{},[3694],{"type":50,"value":3695},"SentinelOne",{"type":45,"tag":118,"props":3697,"children":3698},{},[3699],{"type":50,"value":3595},{"type":45,"tag":96,"props":3701,"children":3702},{},[3703,3712,3717],{"type":45,"tag":118,"props":3704,"children":3705},{},[3706],{"type":45,"tag":238,"props":3707,"children":3709},{"className":3708},[],[3710],{"type":50,"value":3711},".microsoft_defender_endpoint",{"type":45,"tag":118,"props":3713,"children":3714},{},[3715],{"type":50,"value":3716},"Microsoft Defender for Endpoint",{"type":45,"tag":118,"props":3718,"children":3719},{},[3720],{"type":50,"value":3595},{"type":45,"tag":96,"props":3722,"children":3723},{},[3724,3733,3738],{"type":45,"tag":118,"props":3725,"children":3726},{},[3727],{"type":45,"tag":238,"props":3728,"children":3730},{"className":3729},[],[3731],{"type":50,"value":3732},".thehive",{"type":45,"tag":118,"props":3734,"children":3735},{},[3736],{"type":50,"value":3737},"TheHive",{"type":45,"tag":118,"props":3739,"children":3740},{},[3741],{"type":50,"value":3328},{"type":45,"tag":3743,"props":3744,"children":3745},"blockquote",{},[3746],{"type":45,"tag":60,"props":3747,"children":3748},{},[3749,3754,3755,3760,3762,3767],{"type":45,"tag":66,"props":3750,"children":3751},{},[3752],{"type":50,"value":3753},"Note:",{"type":50,"value":3013},{"type":45,"tag":238,"props":3756,"children":3758},{"className":3757},[],[3759],{"type":50,"value":3097},{"type":50,"value":3761}," to discover all available types on your deployment along with their\nexact ",{"type":45,"tag":238,"props":3763,"children":3765},{"className":3764},[],[3766],{"type":50,"value":3232},{"type":50,"value":3768}," values. Connector types for XSOAR, Jira Service Management, and MCP are available but\nmay not appear in older API spec versions.",{"type":45,"tag":53,"props":3770,"children":3772},{"id":3771},"examples",[3773],{"type":50,"value":3774},"Examples",{"type":45,"tag":60,"props":3776,"children":3777},{},[3778,3783,3785,3791,3793,3799,3800,3806,3808,3814],{"type":45,"tag":66,"props":3779,"children":3780},{},[3781],{"type":50,"value":3782},"Create a Slack connector:",{"type":50,"value":3784}," \"Set up Slack notifications for our alerts.\" ",{"type":45,"tag":238,"props":3786,"children":3788},{"className":3787},[],[3789],{"type":50,"value":3790},"POST \u002Fapi\u002Factions\u002Fconnector",{"type":50,"value":3792}," with\n",{"type":45,"tag":238,"props":3794,"children":3796},{"className":3795},[],[3797],{"type":50,"value":3798},"connector_type_id: \".slack\"",{"type":50,"value":1998},{"type":45,"tag":238,"props":3801,"children":3803},{"className":3802},[],[3804],{"type":50,"value":3805},"secrets.webhookUrl",{"type":50,"value":3807},". Use the returned connector ",{"type":45,"tag":238,"props":3809,"children":3811},{"className":3810},[],[3812],{"type":50,"value":3813},"id",{"type":50,"value":3815}," in rule actions.",{"type":45,"tag":60,"props":3817,"children":3818},{},[3819,3824,3826,3832],{"type":45,"tag":66,"props":3820,"children":3821},{},[3822],{"type":50,"value":3823},"Test a connector before attaching to rules:",{"type":50,"value":3825}," \"Verify the PagerDuty connector works.\"\n",{"type":45,"tag":238,"props":3827,"children":3829},{"className":3828},[],[3830],{"type":50,"value":3831},"POST \u002Fapi\u002Factions\u002Fconnector\u002F{id}\u002F_execute",{"type":50,"value":3833}," with a minimal params object to confirm connectivity before adding to any\nrule.",{"type":45,"tag":60,"props":3835,"children":3836},{},[3837,3842,3844,3849,3851,3856,3858,3864],{"type":45,"tag":66,"props":3838,"children":3839},{},[3840],{"type":50,"value":3841},"Audit connector usage before deletion:",{"type":50,"value":3843}," \"Remove the old email connector.\" ",{"type":45,"tag":238,"props":3845,"children":3847},{"className":3846},[],[3848],{"type":50,"value":1351},{"type":50,"value":3850},", inspect\n",{"type":45,"tag":238,"props":3852,"children":3854},{"className":3853},[],[3855],{"type":50,"value":1359},{"type":50,"value":3857}," — if non-zero, reassign the referencing rules first, then ",{"type":45,"tag":238,"props":3859,"children":3861},{"className":3860},[],[3862],{"type":50,"value":3863},"DELETE \u002Fapi\u002Factions\u002Fconnector\u002F{id}",{"type":50,"value":1660},{"type":45,"tag":53,"props":3866,"children":3868},{"id":3867},"guidelines",[3869],{"type":50,"value":3870},"Guidelines",{"type":45,"tag":1985,"props":3872,"children":3873},{},[3874,3886,3896,3921,3932,3945,3950],{"type":45,"tag":1989,"props":3875,"children":3876},{},[3877,3879,3884],{"type":50,"value":3878},"Include ",{"type":45,"tag":238,"props":3880,"children":3882},{"className":3881},[],[3883],{"type":50,"value":724},{"type":50,"value":3885}," on every POST, PUT, and DELETE; omitting it returns 400.",{"type":45,"tag":1989,"props":3887,"children":3888},{},[3889,3894],{"type":45,"tag":238,"props":3890,"children":3892},{"className":3891},[],[3893],{"type":50,"value":560},{"type":50,"value":3895}," is immutable — delete and recreate to change connector type.",{"type":45,"tag":1989,"props":3897,"children":3898},{},[3899,3901,3906,3908,3913,3914,3919],{"type":50,"value":3900},"Always pass ",{"type":45,"tag":238,"props":3902,"children":3904},{"className":3903},[],[3905],{"type":50,"value":3136},{"type":50,"value":3907}," even for connectors with no secrets (e.g., ",{"type":45,"tag":238,"props":3909,"children":3911},{"className":3910},[],[3912],{"type":50,"value":3121},{"type":50,"value":577},{"type":45,"tag":238,"props":3915,"children":3917},{"className":3916},[],[3918],{"type":50,"value":3128},{"type":50,"value":3920},").",{"type":45,"tag":1989,"props":3922,"children":3923},{},[3924,3925,3930],{"type":50,"value":2846},{"type":45,"tag":238,"props":3926,"children":3928},{"className":3927},[],[3929],{"type":50,"value":1359},{"type":50,"value":3931}," before deleting; a deleted connector silently breaks all referencing rule actions.",{"type":45,"tag":1989,"props":3933,"children":3934},{},[3935,3937,3943],{"type":50,"value":3936},"Connectors are space-scoped; prefix paths with ",{"type":45,"tag":238,"props":3938,"children":3940},{"className":3939},[],[3941],{"type":50,"value":3942},"\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Factions\u002F",{"type":50,"value":3944}," for non-default Kibana Spaces.",{"type":45,"tag":1989,"props":3946,"children":3947},{},[3948],{"type":50,"value":3949},"Secrets are write-only: not returned by GET and stripped on Saved Object export\u002Fimport; always re-supply after import.",{"type":45,"tag":1989,"props":3951,"children":3952},{},[3953,3955,3960],{"type":50,"value":3954},"Test every new connector with ",{"type":45,"tag":238,"props":3956,"children":3958},{"className":3957},[],[3959],{"type":50,"value":2836},{"type":50,"value":3961}," before attaching to rules; connector failures in production are silent.",{"type":45,"tag":53,"props":3963,"children":3965},{"id":3964},"additional-resources",[3966],{"type":50,"value":3967},"Additional Resources",{"type":45,"tag":1985,"props":3969,"children":3970},{},[3971,3981,3991,4001,4011,4021],{"type":45,"tag":1989,"props":3972,"children":3973},{},[3974],{"type":45,"tag":896,"props":3975,"children":3978},{"href":3976,"rel":3977},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-connectors",[2934],[3979],{"type":50,"value":3980},"Kibana Connectors API Reference",{"type":45,"tag":1989,"props":3982,"children":3983},{},[3984],{"type":45,"tag":896,"props":3985,"children":3988},{"href":3986,"rel":3987},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fkibana\u002Fconnectors-kibana",[2934],[3989],{"type":50,"value":3990},"Connectors Overview",{"type":45,"tag":1989,"props":3992,"children":3993},{},[3994],{"type":45,"tag":896,"props":3995,"children":3998},{"href":3996,"rel":3997},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fkibana\u002Fconnectors-kibana\u002Fpre-configured-connectors",[2934],[3999],{"type":50,"value":4000},"Preconfigured Connectors",{"type":45,"tag":1989,"props":4002,"children":4003},{},[4004],{"type":45,"tag":896,"props":4005,"children":4008},{"href":4006,"rel":4007},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fkibana\u002Fconfiguration-reference\u002Falerting-settings#action-settings",[2934],[4009],{"type":50,"value":4010},"Alerting Settings (Action Config)",{"type":45,"tag":1989,"props":4012,"children":4013},{},[4014],{"type":45,"tag":896,"props":4015,"children":4018},{"href":4016,"rel":4017},"https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fresources\u002Fkibana_action_connector",[2934],[4019],{"type":50,"value":4020},"Terraform: elasticstack_kibana_action_connector",{"type":45,"tag":1989,"props":4022,"children":4023},{},[4024],{"type":45,"tag":896,"props":4025,"children":4028},{"href":4026,"rel":4027},"https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fguides\u002Felasticstack-kibana-rule",[2934],[4029],{"type":50,"value":4030},"Terraform: Managing Kibana Rule and Connector Resources",{"type":45,"tag":4032,"props":4033,"children":4034},"style",{},[4035],{"type":50,"value":4036},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4038,"total":1953},[4039,4056,4070,4080,4095,4105,4120],{"slug":4040,"name":4040,"fn":4041,"description":4042,"org":4043,"tags":4044,"stars":26,"repoUrl":27,"updatedAt":4055},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4045,4048,4049,4052],{"name":4046,"slug":4047,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":4050,"slug":4051,"type":15},"Operations","operations",{"name":4053,"slug":4054,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":4057,"name":4057,"fn":4058,"description":4059,"org":4060,"tags":4061,"stars":26,"repoUrl":27,"updatedAt":4069},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4062,4063,4066],{"name":4046,"slug":4047,"type":15},{"name":4064,"slug":4065,"type":15},"Deployment","deployment",{"name":4067,"slug":4068,"type":15},"Elasticsearch","elasticsearch","2026-07-12T07:46:42.353362",{"slug":4071,"name":4071,"fn":4072,"description":4073,"org":4074,"tags":4075,"stars":26,"repoUrl":27,"updatedAt":4079},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4076,4077,4078],{"name":4046,"slug":4047,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4050,"slug":4051,"type":15},"2026-07-12T07:46:41.097412",{"slug":4081,"name":4081,"fn":4082,"description":4083,"org":4084,"tags":4085,"stars":26,"repoUrl":27,"updatedAt":4094},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4086,4087,4088,4091],{"name":4046,"slug":4047,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4089,"slug":4090,"type":15},"Networking","networking",{"name":4092,"slug":4093,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":4096,"name":4096,"fn":4097,"description":4098,"org":4099,"tags":4100,"stars":26,"repoUrl":27,"updatedAt":4104},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4101,4102,4103],{"name":231,"slug":228,"type":15},{"name":4046,"slug":4047,"type":15},{"name":4067,"slug":4068,"type":15},"2026-07-12T07:46:39.783105",{"slug":4106,"name":4106,"fn":4107,"description":4108,"org":4109,"tags":4110,"stars":26,"repoUrl":27,"updatedAt":4119},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4111,4114,4115,4118],{"name":4112,"slug":4113,"type":15},"Audit","audit",{"name":4067,"slug":4068,"type":15},{"name":4116,"slug":4117,"type":15},"Logs","logs",{"name":4092,"slug":4093,"type":15},"2026-07-12T07:47:35.092599",{"slug":4121,"name":4121,"fn":4122,"description":4123,"org":4124,"tags":4125,"stars":26,"repoUrl":27,"updatedAt":4130},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4126,4127,4128,4129],{"name":231,"slug":228,"type":15},{"name":9,"slug":8,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4092,"slug":4093,"type":15},"2026-07-12T07:47:41.474547",{"items":4132,"total":4254},[4133,4152,4169,4182,4189,4195,4201,4208,4214,4221,4228,4241],{"slug":4134,"name":4134,"fn":4135,"description":4136,"org":4137,"tags":4138,"stars":4149,"repoUrl":4150,"updatedAt":4151},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4139,4142,4145,4146],{"name":4140,"slug":4141,"type":15},"Analytics","analytics",{"name":4143,"slug":4144,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":4147,"slug":4148,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":4153,"name":4153,"fn":4154,"description":4155,"org":4156,"tags":4157,"stars":4149,"repoUrl":4150,"updatedAt":4168},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4158,4161,4162,4165],{"name":4159,"slug":4160,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":4163,"slug":4164,"type":15},"Engineering","engineering",{"name":4166,"slug":4167,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":4170,"name":4170,"fn":4171,"description":4172,"org":4173,"tags":4174,"stars":4149,"repoUrl":4150,"updatedAt":4181},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4175,4176,4177,4178],{"name":9,"slug":8,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4147,"slug":4148,"type":15},{"name":4179,"slug":4180,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":4040,"name":4040,"fn":4041,"description":4042,"org":4183,"tags":4184,"stars":26,"repoUrl":27,"updatedAt":4055},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4185,4186,4187,4188],{"name":4046,"slug":4047,"type":15},{"name":9,"slug":8,"type":15},{"name":4050,"slug":4051,"type":15},{"name":4053,"slug":4054,"type":15},{"slug":4057,"name":4057,"fn":4058,"description":4059,"org":4190,"tags":4191,"stars":26,"repoUrl":27,"updatedAt":4069},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4192,4193,4194],{"name":4046,"slug":4047,"type":15},{"name":4064,"slug":4065,"type":15},{"name":4067,"slug":4068,"type":15},{"slug":4071,"name":4071,"fn":4072,"description":4073,"org":4196,"tags":4197,"stars":26,"repoUrl":27,"updatedAt":4079},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4198,4199,4200],{"name":4046,"slug":4047,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4050,"slug":4051,"type":15},{"slug":4081,"name":4081,"fn":4082,"description":4083,"org":4202,"tags":4203,"stars":26,"repoUrl":27,"updatedAt":4094},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4204,4205,4206,4207],{"name":4046,"slug":4047,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4089,"slug":4090,"type":15},{"name":4092,"slug":4093,"type":15},{"slug":4096,"name":4096,"fn":4097,"description":4098,"org":4209,"tags":4210,"stars":26,"repoUrl":27,"updatedAt":4104},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4211,4212,4213],{"name":231,"slug":228,"type":15},{"name":4046,"slug":4047,"type":15},{"name":4067,"slug":4068,"type":15},{"slug":4106,"name":4106,"fn":4107,"description":4108,"org":4215,"tags":4216,"stars":26,"repoUrl":27,"updatedAt":4119},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4217,4218,4219,4220],{"name":4112,"slug":4113,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4116,"slug":4117,"type":15},{"name":4092,"slug":4093,"type":15},{"slug":4121,"name":4121,"fn":4122,"description":4123,"org":4222,"tags":4223,"stars":26,"repoUrl":27,"updatedAt":4130},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4224,4225,4226,4227],{"name":231,"slug":228,"type":15},{"name":9,"slug":8,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4092,"slug":4093,"type":15},{"slug":4229,"name":4229,"fn":4230,"description":4231,"org":4232,"tags":4233,"stars":26,"repoUrl":27,"updatedAt":4240},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4234,4235,4236,4239],{"name":9,"slug":8,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4237,"slug":4238,"type":15},"RBAC","rbac",{"name":4092,"slug":4093,"type":15},"2026-07-12T07:47:36.394177",{"slug":4242,"name":4242,"fn":4243,"description":4244,"org":4245,"tags":4246,"stars":26,"repoUrl":27,"updatedAt":4253},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4247,4248,4249,4250],{"name":4140,"slug":4141,"type":15},{"name":4143,"slug":4144,"type":15},{"name":4067,"slug":4068,"type":15},{"name":4251,"slug":4252,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]