> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenSearch

> Reference for the Tracecat OpenSearch integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Acknowledge monitor alerts

Action ID: `tools.opensearch.acknowledge_monitor_alerts`

Acknowledge one or more alerts generated by an OpenSearch Alerting monitor.

Reference: [https://docs.opensearch.org/latest/observing-your-data/alerting/api/](https://docs.opensearch.org/latest/observing-your-data/alerting/api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  Alert IDs to acknowledge.
</ParamField>

<ParamField path="monitor_id" type="string" required>
  Alerting monitor ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Acknowledge Security Analytics alerts

Action ID: `tools.opensearch.acknowledge_security_analytics_alerts`

Acknowledge one or more OpenSearch Security Analytics alerts for a detector.

Reference: [https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/](https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  Alert IDs to acknowledge.
</ParamField>

<ParamField path="detector_id" type="string" required>
  Security Analytics detector ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Count events

Action ID: `tools.opensearch.count_events`

Count OpenSearch events matching an API-native query DSL request body.

Reference: [https://docs.opensearch.org/latest/api-reference/search-apis/count/](https://docs.opensearch.org/latest/api-reference/search-apis/count/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native count request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Optional index name or pattern. If omitted, counts across all indexes.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native count query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get document

Action ID: `tools.opensearch.get_document`

Get an OpenSearch document by index and document ID.

Reference: [https://docs.opensearch.org/latest/api-reference/document-apis/get-documents/](https://docs.opensearch.org/latest/api-reference/document-apis/get-documents/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="document_id" type="string" required>
  Document ID.
</ParamField>

<ParamField path="index" type="string" required>
  Index name.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native get document query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get mapping

Action ID: `tools.opensearch.get_mapping`

Get field mappings for an OpenSearch index or index pattern.

Reference: [https://docs.opensearch.org/latest/api-reference/index-apis/get-mapping/](https://docs.opensearch.org/latest/api-reference/index-apis/get-mapping/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="index" type="string" required>
  Index name or pattern.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native get mapping query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get multiple documents

Action ID: `tools.opensearch.multi_get_documents`

Get multiple OpenSearch documents with an API-native multi-get request.

Reference: [https://docs.opensearch.org/latest/api-reference/document-apis/multi-get/](https://docs.opensearch.org/latest/api-reference/document-apis/multi-get/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native multi-get request body containing docs or ids.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Optional default index for documents in the request.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native multi-get query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List indexes

Action ID: `tools.opensearch.list_indexes`

List OpenSearch indexes as JSON for data-source discovery and threat hunting.

Reference: [https://docs.opensearch.org/latest/api-reference/cat/cat-indices/](https://docs.opensearch.org/latest/api-reference/cat/cat-indices/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Optional index name or pattern used to filter the response.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native CAT indices query parameters. The format parameter is always set to json.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List monitor alerts

Action ID: `tools.opensearch.list_monitor_alerts`

List alerts generated by OpenSearch Alerting monitors for SOAR ingestion and triage.

Reference: [https://docs.opensearch.org/latest/observing-your-data/alerting/api/](https://docs.opensearch.org/latest/observing-your-data/alerting/api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native monitor alert filters and pagination parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List Security Analytics alerts

Action ID: `tools.opensearch.list_security_analytics_alerts`

List OpenSearch Security Analytics alerts for triage and workflow ingestion.

Reference: [https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/](https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Native alert filters and pagination parameters, including detector\_id or detectorType.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List Security Analytics findings

Action ID: `tools.opensearch.list_security_analytics_findings`

List OpenSearch Security Analytics findings and their related documents for triage.

Reference: [https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/](https://docs.opensearch.org/latest/security-analytics/api-tools/alert-finding-api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native finding filters and pagination parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run multiple searches

Action ID: `tools.opensearch.multi_search`

Run multiple OpenSearch searches in one API-native NDJSON request.

Reference: [https://docs.opensearch.org/latest/api-reference/search-apis/multi-search/](https://docs.opensearch.org/latest/api-reference/search-apis/multi-search/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="ndjson" type="string" required>
  API-native multi-search NDJSON containing alternating metadata and query lines.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Optional default index name or pattern for searches in the request.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native multi-search query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run PPL query

Action ID: `tools.opensearch.ppl_query`

Run an OpenSearch Piped Processing Language query for threat hunting and log analysis.

Reference: [https://docs.opensearch.org/latest/search-plugins/sql/sql-ppl-api/](https://docs.opensearch.org/latest/search-plugins/sql/sql-ppl-api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="query" type="string" required>
  PPL query, such as source=logs-\* | where status=401 | head 100.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="format" type="string">
  Response format accepted by the PPL API, such as jdbc, csv, or raw.

  Default: `"jdbc"`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search events

Action ID: `tools.opensearch.search_events`

Search OpenSearch events with an API-native query DSL request body.

Reference: [https://docs.opensearch.org/latest/api-reference/search-apis/search/](https://docs.opensearch.org/latest/api-reference/search-apis/search/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native OpenSearch search request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Optional index name or pattern. If omitted, searches all indexes.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Default result size when the payload does not specify size.

  Default: `100`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native search query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search Security Analytics detectors

Action ID: `tools.opensearch.search_detectors`

Search OpenSearch Security Analytics detector metadata for alert provenance and triage.

Reference: [https://docs.opensearch.org/latest/security-analytics/api-tools/detector-api/](https://docs.opensearch.org/latest/security-analytics/api-tools/detector-api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native detector search request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search Security Analytics rules

Action ID: `tools.opensearch.search_detection_rules`

Search pre-packaged or custom OpenSearch Security Analytics rules for alert context.

Reference: [https://docs.opensearch.org/latest/security-analytics/api-tools/rule-api/](https://docs.opensearch.org/latest/security-analytics/api-tools/rule-api/)

### Secrets

Required secrets:

* `opensearch`: required values `OPENSEARCH_USERNAME`, `OPENSEARCH_PASSWORD`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native rule search request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  OpenSearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="pre_packaged" type="boolean">
  Whether to search pre-packaged rules instead of custom rules.

  Default: `true`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>