Skip to main content

​
Acknowledge monitor alerts

Action ID: tools.opensearch.acknowledge_monitor_alerts Acknowledge one or more alerts generated by an OpenSearch Alerting monitor. Reference: https://docs.opensearch.org/latest/observing-your-data/alerting/api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
array[string]
required
Alert IDs to acknowledge.
​
string
required
Alerting monitor ID.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Acknowledge Security Analytics alerts

Action ID: tools.opensearch.acknowledge_security_analytics_alerts Acknowledge one or more OpenSearch Security Analytics alerts for a detector. Reference: https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
array[string]
required
Alert IDs to acknowledge.
​
string
required
Security Analytics detector ID.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Count events

Action ID: tools.opensearch.count_events Count OpenSearch events matching an API-native query DSL request body. Reference: https://docs.opensearch.org/latest/api-reference/search-apis/count/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
object
required
API-native count request body.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional index name or pattern. If omitted, counts across all indexes.Default: null.
​
object | null
Optional native count query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get document

Action ID: tools.opensearch.get_document Get an OpenSearch document by index and document ID. Reference: https://docs.opensearch.org/latest/api-reference/document-apis/get-documents/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string
required
Document ID.
​
string
required
Index name.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native get document query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get mapping

Action ID: tools.opensearch.get_mapping Get field mappings for an OpenSearch index or index pattern. Reference: https://docs.opensearch.org/latest/api-reference/index-apis/get-mapping/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string
required
Index name or pattern.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native get mapping query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get multiple documents

Action ID: tools.opensearch.multi_get_documents Get multiple OpenSearch documents with an API-native multi-get request. Reference: https://docs.opensearch.org/latest/api-reference/document-apis/multi-get/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
object
required
API-native multi-get request body containing docs or ids.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional default index for documents in the request.Default: null.
​
object | null
Optional native multi-get query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List indexes

Action ID: tools.opensearch.list_indexes List OpenSearch indexes as JSON for data-source discovery and threat hunting. Reference: https://docs.opensearch.org/latest/api-reference/cat/cat-indices/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional index name or pattern used to filter the response.Default: null.
​
object | null
Optional native CAT indices query parameters. The format parameter is always set to json.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List monitor alerts

Action ID: tools.opensearch.list_monitor_alerts List alerts generated by OpenSearch Alerting monitors for SOAR ingestion and triage. Reference: https://docs.opensearch.org/latest/observing-your-data/alerting/api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native monitor alert filters and pagination parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List Security Analytics alerts

Action ID: tools.opensearch.list_security_analytics_alerts List OpenSearch Security Analytics alerts for triage and workflow ingestion. Reference: https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Native alert filters and pagination parameters, including detector_id or detectorType.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List Security Analytics findings

Action ID: tools.opensearch.list_security_analytics_findings List OpenSearch Security Analytics findings and their related documents for triage. Reference: https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native finding filters and pagination parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Run multiple searches

Action ID: tools.opensearch.multi_search Run multiple OpenSearch searches in one API-native NDJSON request. Reference: https://docs.opensearch.org/latest/api-reference/search-apis/multi-search/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string
required
API-native multi-search NDJSON containing alternating metadata and query lines.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional default index name or pattern for searches in the request.Default: null.
​
object | null
Optional native multi-search query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Run PPL query

Action ID: tools.opensearch.ppl_query Run an OpenSearch Piped Processing Language query for threat hunting and log analysis. Reference: https://docs.opensearch.org/latest/search-plugins/sql/sql-ppl-api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
string
required
PPL query, such as source=logs-* | where status=401 | head 100.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
string
Response format accepted by the PPL API, such as jdbc, csv, or raw.Default: "jdbc".
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search events

Action ID: tools.opensearch.search_events Search OpenSearch events with an API-native query DSL request body. Reference: https://docs.opensearch.org/latest/api-reference/search-apis/search/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
object
required
API-native OpenSearch search request body.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional index name or pattern. If omitted, searches all indexes.Default: null.
​
integer
Default result size when the payload does not specify size.Default: 100.
​
object | null
Optional native search query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search Security Analytics detectors

Action ID: tools.opensearch.search_detectors Search OpenSearch Security Analytics detector metadata for alert provenance and triage. Reference: https://docs.opensearch.org/latest/security-analytics/api-tools/detector-api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
object
required
API-native detector search request body.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search Security Analytics rules

Action ID: tools.opensearch.search_detection_rules Search pre-packaged or custom OpenSearch Security Analytics rules for alert context. Reference: https://docs.opensearch.org/latest/security-analytics/api-tools/rule-api/

​
Secrets

Required secrets:
  • opensearch: required values OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD.

​
Input fields

​
object
required
API-native rule search request body.
​
string | null
OpenSearch base URL (e.g. https://localhost:9200).Default: null.
​
boolean
Whether to search pre-packaged rules instead of custom rules.Default: true.
​
boolean
Whether to verify SSL certificates.Default: true.