# Kibana

Kibana is a visualization and analytics platform for Elasticsearch, offering dashboards, data exploration, and monitoring capabilities for gaining insights from data

- **Category:** analytics
- **Auth:** API_KEY, BASIC
- **Composio Managed App Available?** N/A
- **Tools:** 47
- **Triggers:** 0
- **Slug:** `KIBANA`
- **Version:** 20260312_00

## Tools

### Delete Alerting Rule

**Slug:** `KIBANA_DELETE_ALERTING_RULES`

Tool to delete an alerting rule in Kibana. Use when you need to remove a specific alerting rule by its ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | The ID of the rule to delete. |
| `kbn_xsrf` | string | Yes | A required header to protect against CSRF attacks. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Connector

**Slug:** `KIBANA_DELETE_CONNECTORS`

Tool to delete a connector in Kibana. Use when you need to remove an existing connector.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | The unique identifier of the connector to be deleted. |
| `space_id` | string | No | An identifier for the space. If not provided, the default space is used. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Fleet Output

**Slug:** `KIBANA_DELETE_FLEET_OUTPUT`

Tool to delete a specific output configuration in Kibana Fleet. Use when you need to remove an existing output by its ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `kbn_xsrf` | string | No | A header to protect against Cross-Site Request Forgery (CSRF) attacks. Typically 'true' or a generated token. |
| `output_id` | string | Yes | The ID of the output configuration to delete. |
| `elastic_api_version` | string | No | Specifies the API version to use. Defaults to '2023-10-31' if not provided. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Fleet Proxy

**Slug:** `KIBANA_DELETE_FLEET_PROXY`

Deletes a Fleet proxy configuration by its unique identifier. Fleet proxies enable agents to communicate through proxy servers. Use this action to remove proxy configurations that are no longer needed. The proxy must not be in use by any agent policies or outputs before deletion. Requires 'fleet-settings-all' privileges in Kibana.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `kbnXsrf` | string | No | Cross-Site Request Forgery (CSRF) protection header. Must be set to 'true' or a valid token for the request to succeed. |
| `proxyId` | string | Yes | The unique identifier (UUID) of the Fleet proxy configuration to delete. You can retrieve proxy IDs using the Get Fleet Proxies action. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete List

**Slug:** `KIBANA_DELETE_LIST`

Deletes a list. Use when you want to delete a list by its ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | List's id value. |
| `delete_references` | boolean | No | Determines whether exception items referencing this value list should be deleted. |
| `ignore_references` | boolean | No | Determines whether to delete value list without performing any additional checks of where this list may be utilized. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Osquery Saved Query

**Slug:** `KIBANA_DELETE_OSQUERY_SAVED_QUERIES`

Delete a saved Osquery query by its saved object ID. Use this to remove a specific Osquery saved query from Kibana. IMPORTANT: This action requires the 'saved_object_id' (UUID format), not the custom 'id' field. You can obtain the saved_object_id by listing queries first or from the response when creating a query.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | The saved object ID of the Osquery query to delete. This is the 'saved_object_id' field returned when creating or listing queries, NOT the custom 'id' field. Example format: 'a85f2478-23ca-4835-b56f-d6e065114534' |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Saved Object

**Slug:** `KIBANA_DELETE_SAVED_OBJECTS`

Tool to delete a saved object in Kibana. Use when you need to remove a specific saved object like a visualization or dashboard.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | The ID of the saved object to delete. |
| `type` | string | Yes | The type of the saved object. |
| `force` | boolean | No | When true, forces the deletion of objects that exist in multiple namespaces. |
| `kbn_xsrf` | string | No | A required header to protect against CSRF attacks. Defaults to 'true'. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Find Kibana Alerts

**Slug:** `KIBANA_FIND_ALERTS`

Tool to find and/or aggregate detection alerts in Kibana. Use this to retrieve a list of alerts, optionally filtering them with a query and performing aggregations.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `aggs` | object | No | Defines aggregations to be performed. Refer to Elasticsearch aggregation documentation. |
| `size` | integer | No | Number of alerts to return. Defaults to a server-side limit if not specified. |
| `query` | object | No | Elasticsearch query DSL to filter alerts. Supports match_all, term, match, bool, range, exists, wildcard, and other Elasticsearch query types. Defaults to match_all if not specified. |
| `runtime_mappings` | object | No | Defines runtime fields. Refer to Elasticsearch runtime fields documentation. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Action Types

**Slug:** `KIBANA_GET_ACTION_TYPES`

Retrieves all available connector types (actions) in Kibana. Connector types (also called action types) are integrations like Slack, Email, Webhook, ServiceNow, etc. that can be used with alerting rules, cases, and workflows. Use this to discover which connector types are available and their requirements (license, features) before creating a new connector instance. Returns detailed information about each connector type including: - ID (e.g., '.slack', '.email', '.webhook') - Display name and enabled status - License requirements (basic, gold, platinum, enterprise) - Supported features (alerting, cases, workflows, etc.) - Configuration and deprecation status

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Alerting Rules

**Slug:** `KIBANA_GET_ALERTING_RULES`

Tool to retrieve a list of alerting rules in Kibana. Use when you need to get a paginated set of rules based on specified conditions.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number to return. Minimum value is 1; default is 1. |
| `fields` | array | No | Fields to return in the `attributes` key of the response. |
| `filter` | string | No | A KQL string to filter with an attribute from your saved object. |
| `search` | string | No | An Elasticsearch `simple_query_string` to filter the rules. |
| `per_page` | integer | No | Number of rules to return per page. Minimum value is 0; default is 10. |
| `sort_field` | string | No | Field used to sort the results; must exist in the `attributes` key of the response. |
| `sort_order` | string ("asc" | "desc") | No | Sort order. |
| `has_reference` | object | No | Filters rules with a relation to reference objects of a specific type and identifier. |
| `search_fields` | string | No | Fields to perform the `simple_query_string` query against. |
| `filter_consumers` | array | No | List of consumers to filter. |
| `default_search_operator` | string ("OR" | "AND") | No | Default operator for the `simple_query_string`. Default is `OR`. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Rule Types

**Slug:** `KIBANA_GET_ALERT_TYPES`

Retrieves available rule types (alert types) in Kibana. Returns comprehensive metadata about each rule type including: - Available action groups and variables for action templates - License requirements and authorization details - Category (management, observability, securitySolution) - Configuration options like auto-recovery and timeout settings Use this to discover what types of alerting rules can be created in your Kibana instance, such as Elasticsearch query alerts, index threshold alerts, machine learning anomaly detection, and security detection rules.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Cases

**Slug:** `KIBANA_GET_CASES`

Tool to retrieve a list of cases in Kibana. Use when you need to find or list existing security or operational cases, potentially filtering by various attributes like status, assignee, or severity.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `to` | string | No | Returns cases created before a specific date. Must be specified as a KQL date range or date match expression. |
| `from` | string | No | Returns cases created after a specific date. Must be specified as a KQL date range or date match expression. |
| `page` | integer | No | The page number of objects to return. |
| `tags` | string | No | Filters cases by tags. |
| `owner` | string | No | Filters cases by owner. Valid values are `cases`, `observability`, and `securitySolution`. |
| `search` | string | No | Filters response objects using an Elasticsearch `simple_query_string` query. |
| `status` | string ("open" | "in-progress" | "closed") | No | Filters cases by status. |
| `perPage` | integer | No | The number of objects to return per page. |
| `severity` | string ("critical" | "high" | "medium" | "low") | No | Filters cases by severity. |
| `assignees` | string | No | Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. |
| `reporters` | string | No | Filters cases by reporters' usernames. |
| `sortField` | string ("createdAt" | "updatedAt") | No | Determines which field to sort results by. |
| `sortOrder` | string ("asc" | "desc") | No | Determines the sorting order. |
| `searchFields` | string | No | Fields to perform the `simple_query_string` parsed query against. |
| `defaultSearchOperator` | string ("OR" | "AND") | No | The default operator to use for the `simple_query_string`. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get All Connectors

**Slug:** `KIBANA_GET_CONNECTORS`

Tool to retrieve a list of all connectors in Kibana. Use this tool when you need to get information about available connectors.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `space_id` | string | No | An identifier for the space. If not provided, the default space is used. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Data Views

**Slug:** `KIBANA_GET_DATA_VIEWS`

Retrieves all data views (formerly known as index patterns) available in Kibana. Data views define which Elasticsearch indices you want to explore and are used throughout Kibana for features like Discover, Visualize, and Dashboard. This action returns a list of all configured data views with their IDs, names, and index patterns. Use this to discover available data sources before querying specific data views for detailed field information.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Find Detection Engine Rules

**Slug:** `KIBANA_GET_DETECTION_ENGINE_RULES_FIND`

Retrieves a paginated list of Kibana detection engine rules with flexible filtering and sorting options. Use this action to: - List all detection rules in your Kibana security solution - Search for specific rules using KQL filters (by name, tags, severity, enabled status, etc.) - Sort rules by various criteria (name, risk score, creation date, etc.) - Paginate through large rule sets - Select specific fields to return for efficient data retrieval The detection engine rules are used for identifying security threats and generating alerts.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number for pagination, starting at 1. Use with per_page to navigate through large result sets. Defaults to 1. |
| `fields` | array | No | List of specific fields to include in the response. If not specified, all fields are returned. Common fields: 'id', 'name', 'enabled', 'type', 'severity', 'risk_score', 'tags'. |
| `filter` | string | No | KQL (Kibana Query Language) filter to narrow down results. Filter by name, enabled status, tags, creator, interval, or updater. Use 'and'/'or' operators for complex queries. |
| `per_page` | integer | No | Number of rules to return per page (0-10000). Set to 0 to return only metadata without rules. Defaults to 20. |
| `sort_field` | string | No | Field name to sort results by. Common options: 'name', 'created_at', 'updated_at', 'enabled', 'risk_score', 'severity'. Only used when specified (omit for default ordering). |
| `sort_order` | string ("asc" | "desc") | No | Sort direction: 'asc' (ascending) or 'desc' (descending). Defaults to 'desc'. Only applied when sort_field is specified. |
| `gaps_range_end` | string | No | End of time range for gap analysis (ISO 8601 format). Used to identify execution gaps in rules. Must be used with gaps_range_start. Example: '2024-12-31T23:59:59Z'. |
| `gaps_range_start` | string | No | Start of time range for gap analysis (ISO 8601 format). Used to identify execution gaps in rules. Must be used with gaps_range_end. Example: '2024-01-01T00:00:00Z'. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Endpoint List Items

**Slug:** `KIBANA_GET_ENDPOINT_LIST_ITEMS`

Retrieves Elastic Endpoint exception list items with filtering, pagination, and sorting capabilities. Use this action to: - List all endpoint exceptions in the security solution - Filter exceptions by specific field values (e.g., host.name:test-host) - Sort and paginate through exception items - Verify existing exceptions before creating new ones The endpoint exception list contains security exceptions applied to Elastic Endpoint agents.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number to return. Page numbering is 1-based (starts at 1). Defaults to 1 if not specified. |
| `filter` | string | No | Filters results using KQL (Kibana Query Language) syntax with format `<field name>:<field value>`. Fields must be namespaced with saved object type (e.g., 'exception-list-agnostic.attributes.name:my-exception'). Common filterable fields include name, description, tags. Minimum length is 1. |
| `per_page` | integer | No | Number of items per page. Must be at least 1. Defaults to 20 if not specified. |
| `sort_field` | string | No | Field used to sort results. Required if sort_order is specified. Common values: 'created_at', 'updated_at', 'name'. Minimum length is 1. |
| `sort_order` | string ("desc" | "asc") | No | Sort order, either `desc` or `asc`. Must be used together with sort_field - cannot be specified alone. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Entity Store Engines

**Slug:** `KIBANA_GET_ENTITY_STORE_ENGINES`

Retrieves all entity store engines configured in Kibana. Entity store engines aggregate and manage entity data for different entity types (user, host, service). This action returns detailed configuration and status information for all engines, including their current status (installing, started, stopped, error), index patterns, processing parameters, and any error details if applicable. Use this to monitor entity store engines, check their operational status, and review their configuration settings.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Entity Store Entities

**Slug:** `KIBANA_GET_ENTITY_STORE_ENTITIES_LIST`

Tool to list entity records in the entity store with support for paging, sorting, and filtering. Use when you need to retrieve a list of entities such as users, hosts, or services.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number, minimum value is 1. |
| `per_page` | integer | No | Number of records per page, minimum value is 1, maximum value is 10000. |
| `sort_field` | string | No | Field to sort by. |
| `sort_order` | string ("asc" | "desc") | No | Sort order, either 'asc' or 'desc'. |
| `filterQuery` | string | No | Elasticsearch Query DSL (JSON format) to filter results. Must be a valid JSON string representing an Elasticsearch query, e.g., '{"match": {"field": "value"}}'. Leave empty to retrieve all entities. |
| `entity_types` | array | Yes | Types of entities to list; valid values are 'user', 'host', or 'service'. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Entity Store Status

**Slug:** `KIBANA_GET_ENTITY_STORE_STATUS`

Retrieves the current status of the Kibana Entity Store and its configured engines. The Entity Store is a security feature that collects and organizes entity data (users, hosts, etc.) from various sources. This action returns the overall status ('not_installed', 'installing', 'running', 'stopped', or 'error') and details about configured entity engines. Use this to check if the entity store is operational and to view which entity engines are configured.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Agent Policies

**Slug:** `KIBANA_GET_FLEET_AGENT_POLICIES`

Retrieves a paginated list of Fleet agent policies with filtering, sorting, and optional detailed information. Use this action to: - List all agent policies in your Fleet deployment - Filter policies using KQL queries (e.g., by name, namespace, or other fields) - Get agent enrollment counts per policy (use withAgentCount=true) - Retrieve full policy details including package policies (use full=true) - Find policies with available upgrades (use showUpgradeable=true) Agent policies define the configuration for groups of Elastic Agents, including which integrations (package policies) are enabled and how agents should collect and send data.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `full` | boolean | No | Return full policy details including all nested package policies. |
| `page` | integer | No | Page number for pagination (starts at 1). |
| `kuery` | string | No | KQL (Kibana Query Language) filter string to filter agent policies by specific criteria. |
| `format` | string | No | Response format: 'simplified' or 'legacy'. |
| `perPage` | integer | No | Number of items to return per page (max 10,000). |
| `sortField` | string | No | Field name to sort results by (e.g., 'name', 'updated_at', 'created_at'). |
| `sortOrder` | string ("asc" | "desc") | No | Sort direction: 'asc' or 'desc'. |
| `withAgentCount` | boolean | No | Include the number of agents enrolled in each policy in the response. |
| `showUpgradeable` | boolean | No | Filter to show only policies that have upgradeable package policies. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Agents Available Versions

**Slug:** `KIBANA_GET_FLEET_AGENTS_AVAILABLE_VERSIONS`

Tool to retrieve the available versions for Fleet agents. Use when you need to get a list of all available Elastic Agent versions.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `elastic-api-version` | string | No | The version of the Kibana Fleet API to use (format: YYYY-MM-DD). Defaults to '2023-10-31'. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Agents Setup Status

**Slug:** `KIBANA_GET_FLEET_AGENTS_SETUP_STATUS`

Check Fleet setup readiness and identify missing requirements. Returns whether Fleet is ready (isReady), lists any missing prerequisites (missing_requirements), and shows optional feature availability. Use this to verify Fleet is properly configured before managing agents or policies.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Check Fleet Permissions

**Slug:** `KIBANA_GET_FLEET_CHECK_PERMISSIONS`

Tool to check the permissions for the Fleet API. Use when you need to verify if the current user has the necessary privileges for Fleet operations.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `fleetServerSetup` | boolean | No | Indicates if Fleet Server setup permissions should be checked. |
| `elastic-api-version` | string | No | Specifies the API version to use. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Enrollment API Key

**Slug:** `KIBANA_GET_FLEET_ENROLLMENT_API_KEY`

Tool to retrieve details of a specific enrollment API key by its ID. Use when you have the ID of an enrollment API key and need its details.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `key_id` | string | Yes | The ID of the enrollment API key to retrieve. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Enrollment API Keys

**Slug:** `KIBANA_GET_FLEET_ENROLLMENT_API_KEYS`

Tool to fetch a list of enrollment API keys. Use when you need to retrieve existing enrollment tokens for Kibana Fleet.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | The page number to return. Default is 1. |
| `kuery` | string | No | KQL query string to filter the enrollment API keys. |
| `perPage` | integer | No | The number of results to return per page. Default is 20. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet EPM Categories

**Slug:** `KIBANA_GET_FLEET_EPM_CATEGORIES`

Get all available package categories in the Elastic Package Manager (EPM) with package counts. Returns categories like Security, Observability, Cloud, etc., along with the number of packages in each category. Use this to discover available integration categories before browsing or filtering packages.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `prerelease` | boolean | No | If true, include pre-release categories. |
| `elastic_api_version` | string | No | Specifies the API version to use. |
| `include_policy_templates` | boolean | No | If true, count packages with policy templates in category counts. This significantly increases the package counts returned for each category. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet EPM Data Streams

**Slug:** `KIBANA_GET_FLEET_EPM_DATA_STREAMS`

Tool to retrieve the list of data streams in the Elastic Package Manager. Use when you need to get a list of available data streams, optionally filtering by type, dataset, or categorization.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `type` | string | No | Filters data streams by type. Valid values are `logs`, `metrics`, `traces`, `synthetics`, or `profiling`. |
| `sortOrder` | string | No | Specifies the sort order of the results. Valid values are `asc` or `desc`. |
| `datasetQuery` | string | No | Filters data streams by dataset name. |
| `uncategorisedOnly` | boolean | No | If set to `true`, returns only uncategorized data streams. |
| `elastic-api-version` | string | No | Specifies the API version to use. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet EPM Package Details

**Slug:** `KIBANA_GET_FLEET_EPM_PACKAGE_DETAILS`

Retrieves comprehensive details for a specific Fleet integration package version from the Elastic Package Manager (EPM). Returns detailed information including: - Package metadata (name, title, description, version, type) - Installation status and requirements - Data streams and their configurations - Assets (dashboards, visualizations, pipelines) - License and compatibility requirements - Icons and documentation paths Use this action when you need detailed information about a specific package version, such as: - Checking package compatibility requirements - Viewing data streams provided by a package - Accessing package assets and configuration - Verifying installation status and details

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `package_name` | string | Yes | The name of the EPM package (e.g., 'nginx', 'endpoint', 'fleet_server'). Use the Get Fleet EPM Packages or Get Installed EPM Packages actions to find valid package names. |
| `package_version` | string | Yes | The specific version of the package to retrieve (e.g., '1.20.0', '9.3.0'). Use the Get Fleet EPM Packages or Get Installed EPM Packages actions to find available versions. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet EPM Package File

**Slug:** `KIBANA_GET_FLEET_EPM_PACKAGE_FILE`

Retrieves a specific file from an Elastic Package Manager (EPM) package. Use this to access package metadata, documentation, changelogs, or configuration files. Common use cases: inspecting manifest.yml for package details, reading README.md for documentation, or reviewing changelog.yml for version history. Requires a valid package name, version, and file path.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `pkgName` | string | Yes | The name of the EPM package (e.g., 'endpoint', 'nginx', 'fleet_server'). Use the Get Fleet EPM Packages action to discover available packages. |
| `filePath` | string | Yes | The relative path to the file within the package. Common files include 'manifest.yml' (package metadata), 'docs/README.md' (documentation), 'changelog.yml' (version history), and various configuration files. |
| `pkgVersion` | string | Yes | The version of the package (e.g., '1.2.3', '8.0.0'). Use the Get Fleet EPM Packages action to find available versions. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet EPM Packages

**Slug:** `KIBANA_GET_FLEET_EPM_PACKAGES`

Tool to fetch the list of available packages in the Elastic Package Manager. Use when you need to find available integrations or their details.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `category` | string | No | Filter packages by category (e.g., 'security', 'observability', 'web', 'network', 'cloud'). |
| `prerelease` | boolean | No | Include pre-release packages in the results. |
| `excludeInstallStatus` | boolean | No | Exclude installation status information from the response. |
| `withPackagePoliciesCount` | boolean | No | Include the count of package policies using each package. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Installed EPM Packages

**Slug:** `KIBANA_GET_FLEET_EPM_PACKAGES_INSTALLED`

Tool to retrieve the list of installed packages in the Elastic Package Manager. Use this when you need to check which packages are currently installed in Fleet.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet EPM Packages (Limited)

**Slug:** `KIBANA_GET_FLEET_EPM_PACKAGES_LIMITED`

Retrieves a limited list of package names from the Elastic Package Manager (EPM) registry. Returns only package names (strings) without additional metadata, making it faster than the full packages endpoint. Useful for quickly getting a list of available integration packages (maximum 10,000 items). Use this when you only need package names; use the full packages endpoint if you need detailed package information.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get EPM Package Statistics

**Slug:** `KIBANA_GET_FLEET_EPM_PACKAGE_STATS`

Retrieves usage statistics for a specific Fleet package in Kibana, including the number of package policies and agent policies using the package. Use this to understand package adoption and usage across your Fleet-managed agents.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `package_name` | string | Yes | The name of the Fleet package to retrieve usage statistics for (e.g., 'endpoint', 'nginx', 'aws'). |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Package Policies

**Slug:** `KIBANA_GET_FLEET_PACKAGE_POLICIES`

Retrieves a list of Fleet package policies (integration policies) in Kibana. Package policies define how integrations are configured and which agent policies they're associated with. Use this to list all package policies, filter them by criteria, or get their IDs and configurations. Supports pagination, sorting, and KQL filtering.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number for pagination (starts at 1). Default: 1. |
| `kuery` | string | No | KQL (Kibana Query Language) filter to query package policies. Fields must be prefixed with the saved object type 'fleet-package-policies' (e.g., 'fleet-package-policies.name: "my-policy"' or 'fleet-package-policies.namespace: "default"'). |
| `format` | string ("simplified" | "legacy") | No | Response format: 'simplified' for a streamlined response or 'legacy' for backward compatibility. |
| `perPage` | integer | No | Number of items per page (max 10,000). Default: 20. |
| `sortField` | string | No | Field to sort by (e.g., 'name', 'created_at', 'updated_at', 'revision'). |
| `sortOrder` | string ("asc" | "desc") | No | Sort order: 'asc' (ascending) or 'desc' (descending). |
| `withAgentCount` | boolean | No | Include the number of agents using each package policy in the response. |
| `showUpgradeable` | boolean | No | Filter to show only package policies with upgradeable packages. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Server Host

**Slug:** `KIBANA_GET_FLEET_SERVER_HOST`

Tool to fetch details of a specific Fleet server host by its item ID. Use when you need to get information about a particular Fleet Server host.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `host_id` | string | Yes | The ID of the Fleet server host to retrieve. |
| `elastic_api_version` | string | No | Specifies the API version to use. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Fleet Server Hosts

**Slug:** `KIBANA_GET_FLEET_SERVER_HOSTS`

Tool to retrieve the list of Fleet Server hosts. Use when you need to get information about the available Fleet Server hosts.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number of the results to return. |
| `perPage` | integer | No | Number of results to return per page. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Index Management Indices

**Slug:** `KIBANA_GET_INDEX_MANAGEMENT_INDICES`

Tool to fetch information about indices managed by Kibana's Index Management feature. It queries the underlying Elasticsearch /_cat/indices API to retrieve index details. Use when you need to list or get details about one or more indices in the cluster.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `h` | string | No | A comma-separated string of column names to display. If not provided, a default set of columns is shown. Example: 'index,health,status,docs.count,store.size'. |
| `s` | string | No | A comma-separated string of column names or column aliases to sort by. For example, 'index,health'. |
| `pri` | boolean | No | If true, only shows information about primary shards. |
| `bytes` | string ("b" | "k" | "kb" | "m" | "mb" | "g" | "gb" | "t" | "tb" | "p" | "pb") | No | The unit in which to display byte values. |
| `index` | string | No | A comma-separated string of index names or wildcard expressions to limit the returned information. For example, 'my-index-*,another-index'. If not provided, information for all indices is returned. |
| `health` | string ("green" | "yellow" | "red") | No | The health status to filter indices by (green, yellow, or red). |
| `expand_wildcards` | string ("open" | "closed" | "hidden" | "none" | "all") | No | Type of index that wildcard patterns can match. Supports comma-separated values, e.g., 'open,hidden'. 'all' matches all indices by default. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Node Metrics

**Slug:** `KIBANA_GET_METRICS`

Tool to retrieve statistics for nodes in an Elasticsearch cluster, often visualized in Kibana. Use when you need to monitor node health, performance, or resource usage. This action calls the Elasticsearch Nodes Stats API.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `level` | string ("cluster" | "indices" | "shards") | No | Indicates whether statistics are aggregated at the cluster, index, or shard level. |
| `types` | string | No | A comma-separated list of document types for the indexing index metric. |
| `fields` | string | No | Comma-separated list or wildcard expressions of fields to include in the statistics. |
| `groups` | boolean | No | If true, includes search group statistics. |
| `metric` | string | No | Comma-separated list of metrics to retrieve. Examples: jvm, os, process, indices, fs, http, transport, breaker, thread_pool, ingest. |
| `node_id` | string | No | Comma-separated list of node IDs or names to limit the returned information. Special values like '_all', '_local', '_master' can be used. |
| `timeout` | string | No | Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error. |
| `fielddata_fields` | string | No | Comma-separated list or wildcard expressions of fields to include in fielddata statistics. |
| `completion_fields` | string | No | Comma-separated list or wildcard expressions of fields to include in completion suggester statistics. |
| `include_unloaded_segments` | boolean | No | If true, the response includes information from segments that are not loaded into memory. |
| `include_segment_file_sizes` | boolean | No | If true, the call reports the aggregated disk usage of each one of the Lucene index files (only applies if segment stats are requested). |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Reporting Jobs

**Slug:** `KIBANA_GET_REPORTING_JOBS`

Tool to retrieve a list of reporting jobs in Kibana. Use when you need to see pending or completed reports. This uses an internal API endpoint, which might be subject to change without notice.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Saved Objects

**Slug:** `KIBANA_GET_SAVED_OBJECTS`

Tool to retrieve a list of saved objects in Kibana based on specified criteria. Use when you need to find dashboards, visualizations, index patterns, or other saved entities.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | The page number to return. |
| `type` | string | Yes | The type or types of saved objects to find. For example, 'dashboard', 'visualization', or ['index-pattern', 'search']. |
| `fields` | string | No | The fields to return in the response for each saved object. Can be a single field or a list of fields. |
| `filter` | string | No | A Kibana Query Language (KQL) filter string to apply. For example, 'type:dashboard and attributes.title:"My Dashboard"'. |
| `search` | string | No | A search string to filter objects by. Searches the title and description fields by default. |
| `per_page` | integer | No | The number of objects to return per page. |
| `space_id` | string | No | The ID of the Kibana space to search in. Defaults to 'default' space. |
| `sort_field` | string | No | The field to sort the results by. By default, sorts by relevance if 'search' is provided, otherwise by type and then ID. |
| `sort_order` | string ("asc" | "desc") | No | The order to sort the results by, if 'sort_field' is provided. Defaults to 'desc' if 'sort_field' is 'update_at', otherwise 'asc'. |
| `has_reference` | object | No | Filters objects based on the presence of a reference. Expects an object with 'type' and 'id' keys. For example, {'type': 'index-pattern', 'id': 'my-index-pattern'}. |
| `search_fields` | string | No | The fields to search when the 'search' parameter is provided. Can be a single field or a list of fields. |
| `root_search_fields` | string | No | A list of fields to search at the root level of the saved object, in addition to 'search_fields' which target attributes. Useful for fields like 'id' or 'type'. |
| `default_search_operator` | string ("OR" | "AND") | No | The default operator to use for the 'search' query. Defaults to 'OR'. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Kibana Status

**Slug:** `KIBANA_GET_STATUS`

Tool to get the current status of Kibana. Use when you need to check if Kibana is healthy, monitor its state, or get information about the Kibana instance including version, UUID, and metrics.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create Alerting Rule

**Slug:** `KIBANA_POST_ALERTING_RULES`

Tool to create a new alerting rule in Kibana. Use when you need to define a new condition that, when met, triggers an alert and potentially executes predefined actions.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `name` | string | Yes | The name of the rule. While not required to be unique, a distinctive name can help identify a rule. |
| `tags` | array | No | The tags for the rule. Default is an empty array. |
| `params` | object | Yes | The parameters for the rule. |
| `actions` | array | No | An array of action objects. Default is an empty array. |
| `enabled` | boolean | No | Indicates whether to run the rule on an interval basis after it is created. Default is true. |
| `rule_id` | string | No | The identifier for the rule. If omitted, an ID is randomly generated. |
| `consumer` | string | Yes | The name of the application or feature that owns the rule. Examples include `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`. |
| `schedule` | object | Yes | The check interval, specifying how frequently the rule conditions are checked. |
| `throttle` | string | No | Defines how often an alert generates repeated actions. Applicable only if notify_when is set to onThrottleInterval. Examples: '''10s''', '''5m''', '''1h'''. |
| `notify_when` | string | Yes | Indicates how often alerts generate actions. Valid values include `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`. |
| `rule_type_id` | string | Yes | The rule type identifier. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create Case

**Slug:** `KIBANA_POST_CASES`

Tool to create a new case in Kibana. Use when you need to open and track issues, incidents, or investigations. You can assign users, set severity levels, add tags, and configure external connectors for integration with ITSM systems.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `tags` | array | No | Tags for the case |
| `owner` | string ("cases" | "observability" | "securitySolution") | Yes | The application that owns the cases: Stack Management, Observability, or Elastic Security. |
| `title` | string | Yes | A title for the case. |
| `category` | string | No | A word or phrase that categorizes the case. |
| `settings` | object | Yes | An object that contains the case settings. |
| `severity` | string ("critical" | "high" | "medium" | "low") | No | The severity of the case. |
| `assignees` | array | No | Assignees of the case |
| `connector` | string | Yes | Defines properties for connectors. Use .none type to create a case without a connector. |
| `description` | string | Yes | The description for the case. |
| `customFields` | array | No | Custom fields for the case |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create Kibana Connector

**Slug:** `KIBANA_POST_CONNECTORS`

Tool to create a new connector in Kibana. Use when you need to integrate Kibana with an external service.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `id` | string | Yes | An identifier for the connector. |
| `name` | string | Yes | The display name for the connector. |
| `config` | object | No | The connector configuration details. |
| `secrets` | object | No | The connector secrets. |
| `kbn-xsrf` | string | No | A header to protect against CSRF attacks. Default is "true". |
| `connector_type_id` | string | Yes | The type of connector. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create Dashboard

**Slug:** `KIBANA_POST_DASHBOARDS`

Tool to create a new dashboard in Kibana. Use when you need to create a dashboard to visualize data. Dashboards can contain visualizations, saved searches, and other embeddable objects. Note: When using serverless Kibana, you must provide a dashboard_id. The action will automatically fallback to the import API for serverless environments.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `spaces` | array | No | Spaces where the dashboard is available |
| `attributes` | object | Yes | Dashboard attributes |
| `references` | array | No | References to other saved objects |
| `dashboard_id` | string | No | Optional dashboard ID. If not provided, one will be generated |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create Data View

**Slug:** `KIBANA_POST_DATA_VIEWS`

Tool to create a new data view (index pattern) in Kibana. Use when you need to define which Elasticsearch indices to query and analyze in Kibana. Data views determine which fields are available in Discover, Visualize, and other Kibana apps.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `override` | boolean | No | Override an existing data view if it exists |
| `data_view` | object | Yes | Data view specification |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create or Update Saved Object

**Slug:** `KIBANA_POST_SAVED_OBJECTS`

Tool to create or update a saved object in Kibana. Use when you need to programmatically manage Kibana dashboards, visualizations, index patterns, etc.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `space_id` | string | No | The ID of the space to create or update the object in. If not specified, the default space is used. |
| `object_id` | string | No | The ID of the saved object. If an ID is not provided, a randomly generated ID is assigned. |
| `overwrite` | boolean | No | When true, overwrites the document with the same ID. When false, if a document with the specified ID already exists, the request returns a 409 conflict. |
| `attributes` | object | Yes | The attributes of the saved object. The content of this object varies depending on the `type`. |
| `references` | array | No | Objects that this object references. Each reference object must contain `name`, `type`, and `id` fields. |
| `object_type` | string | Yes | The type of the saved object. For example, `dashboard`, `visualization`, `index-pattern`, etc. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |