Skip to content

Commit 7d65c36

Browse files
benskelkerbenskelker
authored
[Docs][SIEM]General doc improvements (#957) (#964)
* adds kib to request urls * adds cross-cluster search links
1 parent 9451e2e commit 7d65c36

15 files changed

+48
-34
lines changed

‎docs/en/siem/index-api-overview.asciidoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ Creates a signal index. The naming convention for the index is
4444

4545
===== Request URL
4646

47-
`POST /api/detection_engine/index`
47+
`POST <kibana host>:<port>/api/detection_engine/index`
4848

4949
====== Example request
5050

@@ -67,7 +67,7 @@ Gets the signal index name if it exists.
6767

6868
===== Request URL
6969

70-
`GET /api/detection_engine/index`
70+
`GET <kibana host>:<port>/api/detection_engine/index`
7171

7272
====== Example request
7373

@@ -114,7 +114,7 @@ Deletes the signal index.
114114

115115
===== Request URL
116116

117-
`DELETE /api/detection_engine/index`
117+
`DELETE <kibana host>:<port>/api/detection_engine/index`
118118

119119
====== Example request
120120

‎docs/en/siem/installation.asciidoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,16 @@ Elastic Cloud. The {es} Service is available on both AWS and GCP.
2020
Service for free].
2121
==============
2222

23+
For information on how to perform cross-cluster searches on {siem-soln}
24+
indices, see:
25+
26+
* {ref}/modules-cross-cluster-search.html[Search across cluster]
27+
(for on-premises {stack} deployments)
28+
* {cloud}/ec-enable-ccs.html[Enable cross-cluster search] (for hosted deployments)
29+
30+
[float]
31+
=== Ingest data
32+
2333
To ingest data, you can use:
2434

2535
* *{beats}* shippers (version 7.x or later) installed for each system you want

‎docs/en/siem/privileges-api-overview.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Returns user privileges for the {kib} space.
1414

1515
===== Request URL
1616

17-
`GET /api/detection_engine/privileges`
17+
`GET <kibana host>:<port>/api/detection_engine/privileges`
1818

1919
====== Example requests
2020

‎docs/en/siem/rules-api-bulk-actions.asciidoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Creates new rules.
1010

1111
===== Request URL
1212

13-
`POST /api/detection_engine/rules/_bulk_create`
13+
`POST <kibana host>:<port>/api/detection_engine/rules/_bulk_create`
1414

1515
===== Request body
1616

@@ -82,7 +82,7 @@ Deletes multiple rules.
8282

8383
===== Request URL
8484

85-
`DELETE /api/detection_engine/rules/_bulk_delete`
85+
`DELETE <kibana host>:<port>/api/detection_engine/rules/_bulk_delete`
8686

8787
===== Request body
8888

@@ -124,9 +124,9 @@ You can use `PUT` or `PATCH` methods to bulk update rules, where:
124124

125125
===== Request URL
126126

127-
`PUT /api/detection_engine/rules/_bulk_update`
127+
`PUT <kibana host>:<port>/api/detection_engine/rules/_bulk_update`
128128

129-
`PATCH /api/detection_engine/rules/_bulk_update`
129+
`PATCH <kibana host>:<port>/api/detection_engine/rules/_bulk_update`
130130

131131
===== Request body
132132

‎docs/en/siem/rules-api-create.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Creates a new signal detection rule.
55

66
==== Request URL
77

8-
`POST /api/detection_engine/rules`
8+
`POST <kibana host>:<port>/api/detection_engine/rules`
99

1010
==== Request body
1111

‎docs/en/siem/rules-api-delete.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Deletes a single rule using the `rule_id` or `id` field.
55

66
==== Request URL
77

8-
`DELETE /api/detection_engine/rules`
8+
`DELETE <kibana host>:<port>/api/detection_engine/rules`
99

1010
===== URL query parameters
1111

‎docs/en/siem/rules-api-export.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ NOTE: You cannot export prepackaged rules.
77

88
==== Request URL
99

10-
`POST /api/detection_engine/rules/_export`
10+
`POST <kibana host>:<port>/api/detection_engine/rules/_export`
1111

1212

1313
===== URL query parameters

‎docs/en/siem/rules-api-find.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Retrieves a paginated subset of signal detection rules. By default, the first pa
55

66
==== Request URL
77

8-
`GET /api/detection_engine/rules/_find`
8+
`GET <kibana host>:<port>/api/detection_engine/rules/_find`
99

1010
===== URL query parameters
1111

‎docs/en/siem/rules-api-get.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Retrieves a single rule using the `rule_id` or `id` field.
55

66
==== Request URL
77

8-
`GET /api/detection_engine/rules`
8+
`GET <kibana host>:<port>/api/detection_engine/rules`
99

1010
===== URL query parameters
1111

‎docs/en/siem/rules-api-import.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Imports rules from an ndjson file.
55

66
==== Request URL
77

8-
`POST /api/detection_engine/rules/_import`
8+
`POST <kibana host>:<port>/api/detection_engine/rules/_import`
99

1010
The request must include:
1111

‎docs/en/siem/rules-api-overview.asciidoc

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,24 @@ and alerts, see <<det-engine-terminology, detections terminology>>.
1212

1313
The API has these endpoints:
1414

15-
* `<kibana URL>/api/detection_engine/rules` - Signal detection rules CRUD
16-
functions
17-
* `<kibana URL>/api/detection_engine/index` - Signal index operations
18-
* `<kibana URL>/api/detection_engine/tags` - Aggregates and returns rule tags
19-
* `<kibana URL>/api/detection_engine/_import` - Imports rules from an ndjson
20-
file
21-
* `<kibana URL>/api/detection_engine/_export` - Exports rules to an ndjson file
22-
* `<kibana URL>/api/detection_engine/privileges` - Returns the user's
15+
* `<kibana host>:<port>/api/detection_engine/rules` - Signal detection rules
16+
CRUD functions
17+
* `<kibana host>:<port>/api/detection_engine/index` - Signal index operations
18+
* `<kibana host>:<port>/api/detection_engine/tags` - Aggregates and returns
19+
rule tags
20+
* `<kibana host>:<port>/api/detection_engine/_import` - Imports rules from an
21+
ndjson file
22+
* `<kibana host>:<port>/api/detection_engine/_export` - Exports rules to an
23+
ndjson file
24+
* `<kibana host>:<port>/api/detection_engine/privileges` - Returns the user's
2325
{kib} space and signal index permissions, and whether the user is authenticated
24-
* `<kibana URL>/api/detection_engine/signals` - Aggregates, queries, and
26+
* `<kibana host>:<port>/api/detection_engine/signals` - Aggregates, queries, and
2527
returns signals, and updates their statuses
26-
* `<kibana URL>/api/detection_engine/prepackaged` - Loads and retrieves the status of Elastic <<prebuilt-rules, prebuilt rules>>
28+
* `<kibana host>:<port>/api/detection_engine/prepackaged` - Loads and retrieves
29+
the status of Elastic <<prebuilt-rules, prebuilt rules>>
2730

28-
Where `<kibana URL>` is the URL and port number of your Kibana instance.
31+
Where `<kibana host>` is the host name and `<port>` is the port of your {kib}
32+
instance.
2933

3034
NOTE: In dev mode, the Kibana server runs behind a proxy which adds a random
3135
path component to its URL.
@@ -38,7 +42,7 @@ how to work with and disable the random path component.
3842
If you are making calls to a {kib} space *other than* the `Default` space, the
3943
space identifier is part of the endpoint's URL:
4044

41-
`<kibana URL>/s/<space URL>/api/detection_engine/rules`
45+
`<kibana host>:<port>/s/<space URL>/api/detection_engine/rules`
4246

4347
Where `<space URL>` is the URL identifier for the space.
4448

@@ -79,6 +83,6 @@ from the {kib} `siem` space:
7983

8084
[source,js]
8185
--------------------------------------------------
82-
curl -X GET "<kibana URL>/s/siem/api/detection_engine/rules/_find"
86+
curl -X GET "<kibana host>:<port>/s/siem/api/detection_engine/rules/_find"
8387
-H 'kbn-xsrf: kibana' -u <username>:<password>
8488
--------------------------------------------------

‎docs/en/siem/rules-api-prebuilt.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ NOTE: By default, all loaded prebuilt rules are disabled.
1313

1414
===== Request URL
1515

16-
`PUT /api/detection_engine/rules/prepackaged`
16+
`PUT <kibana host>:<port>/api/detection_engine/rules/prepackaged`
1717

1818
====== Example request
1919

@@ -48,7 +48,7 @@ Returns rule statuses.
4848

4949
===== Request URL
5050

51-
`GET /api/detection_engine/rules/prepackaged/_status`
51+
`GET <kibana host>:<port>/api/detection_engine/rules/prepackaged/_status`
5252

5353
====== Example request
5454

‎docs/en/siem/rules-api-update.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ You can use `PUT` or `PATCH` methods to update rules, where:
1010

1111
==== Request URL
1212

13-
`PUT /api/detection_engine/rules`
13+
`PUT <kibana host>:<port>/api/detection_engine/rules`
1414

15-
`PATCH /api/detection_engine/rules`
15+
`PATCH <kibana host>:<port>/api/detection_engine/rules`
1616

1717
==== Request body
1818

‎docs/en/siem/signals-api-overview.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Aggregates and returns signals.
1616

1717
===== Request URL
1818

19-
`POST /api/detection_engine/signals/search`
19+
`POST <kibana host>:<port>/api/detection_engine/signals/search`
2020

2121
===== Request body
2222

@@ -116,7 +116,7 @@ Sets the status of one or more signals.
116116

117117
===== Request URL
118118

119-
`POST /api/detection_engine/signals/status`
119+
`POST <kibana host>:<port>/api/detection_engine/signals/status`
120120

121121
===== Request body
122122

‎docs/en/siem/tags-api-overview.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Aggregates and returns all unique tags from all rules.
1010

1111
===== Request URL
1212

13-
`GET /api/detection_engine/tags`
13+
`GET <kibana host>:<port>/api/detection_engine/tags`
1414

1515
====== Example request
1616

0 commit comments

Comments
 (0)