### Populate Rule Setup Guide

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-findrules

Provide setup instructions for the rule including prerequisites, required integrations, configuration steps, and other dependencies needed for proper rule operation.

```json
{
  "setup": "Install the Endpoint package and enable process monitoring. Configure Osquery as described in the integration documentation."
}
```

--------------------------------

### Initiate Fleet Setup with Curl

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-setup

Example of how to initiate the Fleet setup process in Kibana using a curl command. This requires specifying the API endpoint, authorization token, and a kbn-xsrf header for security.

```curl
curl \
 --request POST 'https://localhost:5601/api/fleet/setup' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: true"
```

--------------------------------

### Get Agent Setup Info (cURL)

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-agents-setup

This cURL command demonstrates how to retrieve agent setup information from the Kibana Fleet API. It requires an API key for authorization and specifies the endpoint URL. The response will indicate the readiness and requirements for agent setup.

```curl
curl \
 --request GET 'https://localhost:5601/api/fleet/agents/setup' \
 --header "Authorization: $API_KEY"
```

--------------------------------

### GET /api/fleet/agents/setup

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-agents-setup

Retrieves the current setup information for Elastic Fleet agents, including security status, storage configuration, and any missing requirements or optional features. This endpoint is used to verify that all prerequisites are met for agent deployment and operation.

```APIDOC
## GET /api/fleet/agents/setup

### Description
Retrieve agent setup information including security configuration, storage settings, and any missing requirements or optional features for Fleet.

### Method
GET

### Endpoint
/api/fleet/agents/setup

### Alternative Endpoint (Spaces)
/s/{space_id}/api/fleet/agents/setup

### Authentication
- API Key Authentication
- Basic Authentication

### Authorization
Required privileges: `fleet-agents-read` OR `fleet-agent-policies-read` OR `fleet-settings-read` OR `fleet-setup`

### Parameters
No parameters required.

### Request Example
```bash
curl \
  --request GET 'https://localhost:5601/api/fleet/agents/setup' \
  --header "Authorization: $API_KEY"
```

### Response

#### Success Response (200 OK)
- **is_secrets_storage_enabled** (boolean) - Optional - Indicates if secrets storage is enabled
- **is_space_awareness_enabled** (boolean) - Optional - Indicates if space awareness is enabled
- **isReady** (boolean) - Required - Whether the Fleet setup is ready for agent deployment
- **missing_optional_features** (array[string]) - Required - List of optional features that are not configured. Values: `encrypted_saved_object_encryption_key_required`
- **missing_requirements** (array[string]) - Required - List of missing requirements. Values: `security_required`, `tls_required`, `api_keys`, `fleet_admin_user`, `fleet_server`
- **package_verification_key_id** (string) - Optional - ID of the package verification key

#### Response Example (Success)
```json
{
  "isReady": true,
  "is_secrets_storage_enabled": true,
  "is_space_awareness_enabled": false,
  "missing_optional_features": [],
  "missing_requirements": [],
  "package_verification_key_id": "key-123"
}
```

#### Error Response (400 Bad Request)
- **error** (string) - Optional - Error identifier
- **errorType** (string) - Optional - Type of error
- **message** (string) - Required - Human-readable error message
- **statusCode** (number) - HTTP status code

#### Error Response Example
```json
{
  "error": "Bad Request",
  "errorType": "validation_error",
  "message": "Invalid request parameters",
  "statusCode": 400
}
```
```

--------------------------------

### Install Prebuilt Detection Rules and Timelines Response (JSON)

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-installprebuiltrulesandtimelines

Example JSON response indicating the number of rules and Timelines installed and updated after calling the prepackaged detection rules endpoint. This confirms the successful execution of the installation or update process.

```json
{
  "rules_updated": 0,
  "rules_installed": 112,
  "timelines_updated": 2,
  "timelines_installed": 5
}
```

--------------------------------

### Bulk Install Packages using cURL

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-epm-packages-bulk

Example of how to install multiple Elastic Agent packages in bulk using the Kibana Fleet API with cURL. This demonstrates the POST request, endpoint, authentication headers, and the JSON payload structure. Ensure you replace `$API_KEY` with your actual API key.

```curl
curl \
 --request POST 'https://localhost:5601/api/fleet/epm/packages/_bulk' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"force":false,"packages":["string"]}'
```

--------------------------------

### GET /websites/elastic_co_api_doc_kibana_v9

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-epm-packages-pkgname-pkgversion

This endpoint retrieves information related to Kibana v9 configurations and installed assets. It provides details on agents, asset tags, categories, data streams, download options, and installation status.

```APIDOC
## GET /websites/elastic_co_api_doc_kibana_v9

### Description
This endpoint retrieves detailed information about Kibana v9 configurations, including installed assets, data streams, and installation status. It allows for a comprehensive overview of the Kibana environment.

### Method
GET

### Endpoint
/websites/elastic_co_api_doc_kibana_v9

### Parameters
#### Query Parameters
(No query parameters are documented for this endpoint)

#### Path Parameters
(No path parameters are documented for this endpoint)

### Request Body
(This endpoint does not accept a request body)

### Request Example
(No request example available)

### Response
#### Success Response (200)
- **item** (object) - Required. Contains detailed information about the Kibana v9 configuration.
  - **agent** (object) - Additional properties are NOT allowed.
    - **privileges** (object) - Additional properties are NOT allowed.
      - **root** (boolean)
  - **asset_tags** (array[object])
    - **asset_ids** (array[string])
    - **asset_types** (array[string])
    - **text** (string) - Required
  - **assets** (object) - Required. Additional properties are allowed.
    - **categories** (array[string])
    - **conditions** (object) - Additional properties are allowed.
      - **elastic** (object) - Additional properties are allowed.
        - **capabilities** (array[string])
        - **subscription** (string)
      - **kibana** (object) - Additional properties are allowed.
        - **version** (string)
  - **data_streams** (array[object]) - Additional properties are allowed.
  - **description** (string)
  - **discovery** (object) - Additional properties are allowed.
    - **datasets** (array[object]) - Additional properties are allowed.
      - **name** (string) - Required
    - **fields** (array[object]) - Additional properties are allowed.
      - **name** (string) - Required
  - **download** (string)
  - **elasticsearch** (object) - Additional properties are allowed.
    - **format_version** (string)
    - **icons** (array[object])
      - **dark_mode** (boolean)
      - **path** (string)
      - **size** (string)
      - **src** (string) - Required
      - **title** (string)
      - **type** (string)
  - **installationInfo** (object) - Additional properties are allowed.
    - **additional_spaces_installed_kibana** (object)
      - ***** (array[object]) - Additional properties
        - **deferred** (boolean)
        - **id** (string) - Required
        - **originId** (string)
        - **type** (string) - Required. Any of: `dashboard`, `lens`, `visualization`, `search`, `index-pattern`, `map`, `ml-module`, `security-rule`, `csp-rule-template`, `osquery-pack-asset`, `osquery-saved-query`, or `tag`.
    - **created_at** (string)
    - **experimental_data_stream_features** (array[object])
      - **data_stream** (string) - Required
      - **features** (object) - Required. Additional properties are allowed.
        - **doc_value_only_numeric** (boolean)
        - **doc_value_only_other** (boolean)
        - **synthetic_source** (boolean)
        - **tsdb** (boolean)
    - **install_format_schema_version** (string)
    - **install_source** (string) - Required. Values are `registry`, `upload`, `bundled`, or `custom`.
    - **install_status** (string) - Required. Values are `installed`, `installing`, or `install_failed`.
    - **installed_es** (array[object]) - Required
      - **deferred** (boolean)
      - **id** (string) - Required
      - **type** (string) - Required. Values are `index`, `index_template`, `component_template`, `ingest_pipeline`, `ilm_policy`, `data_stream_ilm_policy`, `transform`, `ml_model`, or `knowledge_base`.
      - **version** (string)
    - **installed_kibana** (array[object]) - Required
      - **deferred** (boolean)
      - **id** (string) - Required
      - **originId** (string)
      - **type** (string) - Required. Any of: `dashboard`, `lens`, `visualization`, `search`, `index-pattern`, `map`, `ml-module`, `security-rule`, `csp-rule-template`, `osquery-pack-asset`, `osquery-saved-query`, or `tag`.
    - **installed_kibana_space_id** (string)
    - **latest_executed_state** (object) - Additional properties are allowed.
      - **error** (string)
      - **name** (string)
      - **started_at** (string)
    - **latest_install_failed_attempts** (array[object])

#### Response Example
```json
{
  "item": {
    "agent": {
      "privileges": {
        "root": true
      }
    },
    "asset_tags": [
      {
        "asset_ids": ["asset-123"],
        "asset_types": ["dashboard"],
        "text": "example tag"
      }
    ],
    "assets": {
      "categories": ["monitoring"],
      "conditions": {
        "elastic": {
          "capabilities": ["monitor"],
          "subscription": "basic"
        },
        "kibana": {
          "version": "9.0.0"
        }
      }
    },
    "data_streams": [
      {
        "description": "Logs data stream"
      }
    ],
    "discovery": {
      "datasets": [
        {
          "name": "logs"
        }
      ],
      "fields": [
        {
          "name": "@timestamp"
        }
      ]
    },
    "download": "https://example.com/download/kibana.zip",
    "elasticsearch": {
      "format_version": "7.14.0",
      "icons": [
        {
          "dark_mode": false,
          "path": "/icons/logo.svg",
          "size": "medium",
          "src": "logo.svg",
          "title": "Elastic Logo",
          "type": "image"
        }
      ]
    },
    "installationInfo": {
      "additional_spaces_installed_kibana": {
        "space1": [
          {
            "deferred": false,
            "id": "dashboard-abc",
            "originId": "original-dashboard-id",
            "type": "dashboard"
          }
        ]
      },
      "created_at": "2023-10-27T10:00:00Z",
      "experimental_data_stream_features": [
        {
          "data_stream": "logs",
          "features": {
            "doc_value_only_numeric": false,
            "doc_value_only_other": false,
            "synthetic_source": false,
            "tsdb": true
          }
        }
      ],
      "install_format_schema_version": "1.0.0",
      "install_source": "registry",
      "install_status": "installed",
      "installed_es": [
        {
          "deferred": false,
          "id": "index-template-logs",
          "type": "index_template",
          "version": "1.0.0"
        }
      ],
      "installed_kibana": [
        {
          "deferred": false,
          "id": "visualization-cpu-usage",
          "originId": "original-viz-id",
          "type": "visualization"
        }
      ],
      "installed_kibana_space_id": "default",
      "latest_executed_state": {
        "error": null,
        "name": "install",
        "started_at": "2023-10-27T10:05:00Z"
      },
      "latest_install_failed_attempts": []
    }
  }
}
```
```

--------------------------------

### POST /api/fleet/setup

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-setup

Initiates the Fleet setup process. This endpoint requires API key or Basic authentication and specific route privileges. A CSRF token is also required.

```APIDOC
## POST /api/fleet/setup

### Description
Initiates the Fleet setup process. This endpoint requires API key or Basic authentication and specific route privileges. A CSRF token is also required.

### Method
POST

### Endpoint
/api/fleet/setup

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks

### Request Example
```curl
curl \
 --request POST 'https://localhost:5601/api/fleet/setup' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: true"
```

### Response
#### Success Response (200)
- **isInitialized** (boolean) - Required - Indicates if the setup has been initialized.
- **nonFatalErrors** (array[object]) - Required - A list of non-fatal errors encountered during setup.
  - **message** (string) - Required - The error message.
  - **name** (string) - Required - The name of the error.

#### Error Response (400)
- **error** (string) - The error description.
- **errorType** (string) - The type of error.
- **message** (string) - Required - The error message.
- **statusCode** (number) - The HTTP status code.

#### Error Response (500)
- **message** (string) - Required - The error message.

#### Response Example (200)
```json
{
  "isInitialized": true,
  "nonFatalErrors": []
}
```
```

--------------------------------

### GET /api/entity_analytics/privileged_user_monitoring/pad/status

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-installprivilegedaccessdetectionpackage

Retrieves the current status of the privileged access detection package, including installation status, machine learning module setup status, and job information for the Entity Analytics privileged user monitoring experience.

```APIDOC
## GET /api/entity_analytics/privileged_user_monitoring/pad/status

### Description
Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience.

### Method
GET

### Endpoint
/api/entity_analytics/privileged_user_monitoring/pad/status

### Authentication
- Api key auth
- Basic auth

### Spaces
Alternative path with space ID: `get /s/{space_id}/api/entity_analytics/privileged_user_monitoring/pad/status`

### Response
#### Success Response (200)
- **package_installation_status** (string) - Required - Installation status of the PAD package. Values: `complete` or `incomplete`
- **ml_module_setup_status** (string) - Required - Machine learning module setup status. Values: `complete` or `incomplete`
- **jobs** (array[object]) - Required - Array of job objects with the following properties:
  - **job_id** (string) - Required - Unique identifier for the job
  - **state** (string) - Required - Current state of the job. Values: `closing`, `closed`, `opened`, `failed`, or `opening`
  - **description** (string) - Optional - Description of the job

#### Response Example
```json
{
  "package_installation_status": "complete",
  "ml_module_setup_status": "complete",
  "jobs": [
    {
      "job_id": "job_1",
      "state": "opened",
      "description": "Privileged access detection job"
    }
  ]
}
```

### Request Example
```bash
curl \
  --request GET 'https://localhost:5601/api/entity_analytics/privileged_user_monitoring/pad/status' \
  --header "Authorization: $API_KEY"
```
```

--------------------------------

### GET /api/entity_analytics/privileged_user_monitoring/pad/status

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-getprivilegedaccessdetectionpackagestatus

Retrieves the current status of the privileged access detection package for Entity Analytics privileged user monitoring. Returns information about PAD jobs, ML module setup status, and package installation status.

```APIDOC
## GET /api/entity_analytics/privileged_user_monitoring/pad/status

### Description
Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience. This endpoint provides detailed information about PAD job states, ML module configuration, and package installation status.

### Method
GET

### Endpoint
/api/entity_analytics/privileged_user_monitoring/pad/status

### Authentication
- API Key Authentication
- Basic Authentication

### Spaces
This operation supports Kibana Spaces. Use the following path format:
```
GET /s/{space_id}/api/entity_analytics/privileged_user_monitoring/pad/status
```

### Response
#### Success Response (200)
Privileged access detection status retrieved successfully.

**Response Body:**
- **jobs** (array[object]) - Required - Array of privileged access detection jobs
  - **job_id** (string) - Required - Unique identifier for the job
  - **state** (string) - Required - Current state of the job. Values: `closing`, `closed`, `opened`, `failed`, `opening`
  - **description** (string) - Description of the job
- **ml_module_setup_status** (string) - Required - Status of ML module setup. Values: `complete`, `incomplete`
- **package_installation_status** (string) - Required - Status of package installation. Values: `complete`, `incomplete`

### Response Example
```json
{
  "jobs": [
    {
      "job_id": "privileged_access_detection_job",
      "state": "opened",
      "description": "Monitoring privileged user activities"
    }
  ],
  "ml_module_setup_status": "complete",
  "package_installation_status": "complete"
}
```

### Request Example
```bash
curl \
  --request GET 'https://localhost:5601/api/entity_analytics/privileged_user_monitoring/pad/status' \
  --header "Authorization: $API_KEY"
```

### Content-Type
application/json
```

--------------------------------

### Get a Synthetics Parameter by ID - Response Examples

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-parameter

Provides example JSON responses for successfully retrieving a Synthetics parameter. The 'value' attribute is only present for users with write permissions, while 'description' and 'namespaces' are included for users with read-only access.

```json
{
  "id": "unique-parameter-id",
  "key": "your-api-key",
  "description": "Param to use in browser monitor",
  "tags": ["authentication", "security"],
  "namespaces": ["namespace1", "namespace2"]
}
```

```json
{
  "id": "unique-parameter-id",
  "key": "your-param-key",
  "description": "Param to use in browser monitor",
  "tags": ["authentication", "security"],
  "namespaces": ["namespace1", "namespace2"],
  "value": "your-param-value"
}
```

--------------------------------

### Initiate Agent Setup with cURL

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-agents-setup

This snippet demonstrates how to initiate the agent setup process using the Kibana Fleet API via cURL. It requires an API key for authorization and the 'kbn-xsrf' header for security. The request targets the '/api/fleet/agents/setup' endpoint on a local Kibana instance.

```curl
curl \
 --request POST 'https://localhost:5601/api/fleet/agents/setup' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: true"
```

--------------------------------

### Get Monitor Response Example - JSON

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-synthetic-monitor

Example response body from a successful GET request to retrieve a monitor. Contains monitor metadata including type, configuration, schedule, locations, SSL/TLS settings, and timestamps. Demonstrates the full structure of an HTTP monitor resource.

```json
{
    "type": "http",
    "enabled": true,
    "alert": {
        "status": {
            "enabled": true
        },
        "tls": {
            "enabled": true
        }
    },
    "schedule": {
        "number": "3",
        "unit": "m"
    },
    "config_id": "a8188705-d01e-4bb6-87a1-64fa5e4b07ec",
    "timeout": "16",
    "name": "am i something",
    "locations": [
        {
            "id": "us_central",
            "label": "North America - US Central",
            "geo": {
                "lat": 41.25,
                "lon": -95.86
            },
            "isServiceManaged": true
        }
    ],
    "namespace": "default",
    "origin": "ui",
    "id": "a8188705-d01e-4bb6-87a1-64fa5e4b07ec",
    "max_attempts": 2,
    "__ui": {
        "is_tls_enabled": false
    },
    "max_redirects": "0",
    "response.include_body": "on_error",
    "response.include_headers": true,
    "check.request.method": "GET",
    "mode": "any",
    "response.include_body_max_bytes": "1024",
    "ipv4": true,
    "ipv6": true,
    "ssl.verification_mode": "full",
    "ssl.supported_protocols": [
        "TLSv1.1",
        "TLSv1.2",
        "TLSv1.3"
    ],
    "revision": 13,
    "created_at": "2023-11-08T08:45:29.334Z",
    "updated_at": "2023-12-18T20:31:44.770Z",
    "url": "https://fast.com"
}
```

--------------------------------

### POST /api/fleet/agents/setup

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-agents-setup

Initiates the setup process for agents in Kibana Fleet. This endpoint supports API key authentication and basic authentication. It requires specific route privileges and a CSRF protection header.

```APIDOC
## POST /api/fleet/agents/setup

### Description
Initiates the setup process for agents in Kibana Fleet. This endpoint supports API key authentication and basic authentication. It requires specific route privileges and a CSRF protection header.

### Method
POST

### Endpoint
`/api/fleet/agents/setup`

### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks

### Authorization
Api key auth or Basic auth

### Required Privileges
fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup

### Responses
#### Success Response (200)
- **isInitialized** (boolean) - Required - Indicates if the setup was successful.
- **nonFatalErrors** (array[object]) - Required - A list of non-fatal errors encountered during setup.
  - **message** (string) - Required - The error message.
  - **name** (string) - Required - The name of the error.

#### Error Response (400)
- **error** (string) - The error details.
- **errorType** (string) - The type of error.
- **message** (string) - Required - A message describing the bad request.
- **statusCode** (number) - The HTTP status code.

### Request Example
```curl
curl \
 --request POST 'https://localhost:5601/api/fleet/agents/setup' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: true"
```
```

--------------------------------

### Get Remote Synced Integrations Status - cURL Request

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-remote-synced-integrations-status

Retrieves the synchronization status of all remote synced integrations using HTTP GET request with API key authentication. This endpoint returns comprehensive status information including sync states (completed, synchronizing, failed, or warning), installation status for both main and remote installations, and any associated warnings or errors.

```bash
curl \
 --request GET 'https://localhost:5601/api/fleet/remote_synced_integrations/status' \
 --header "Authorization: $API_KEY"
```

--------------------------------

### Example Successful Response for Get Monitors

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-synthetic-monitors

This is an example of a successful JSON response (200 OK) when retrieving synthetic monitors. It includes pagination details like 'page', 'total', and 'perPage', along with an array of 'monitors' objects, each containing detailed information about a single monitor.

```json
{
    "page": 1,
    "total": 24,
    "monitors": [
        {
            "type": "icmp",
            "enabled": false,
            "alert": {
                "status": {
                    "enabled": true
                },
                "tls": {
                    "enabled": true
                }
            },
            "schedule": {
                "number": "3",
                "unit": "m"
            },
            "config_id": "e59142e5-1fe3-4aae-b0b0-19d6345e65a1",
            "timeout": "16",
            "name": "8.8.8.8:80",
            "locations": [
                {
                    "id": "us_central",
                    "label": "North America - US Central",
                    "geo": {
                        "lat": 41.25,
                        "lon": -95.86
                    },
                    "isServiceManaged": true
                }
            ],
            "namespace": "default",
            "origin": "ui",
            "id": "e59142e5-1fe3-4aae-b0b0-19d6345e65a1",
            "max_attempts": 2,
            "wait": "7",
            "revision": 3,
            "mode": "all",
            "ipv4": true,
            "ipv6": true,
            "created_at": "2023-11-07T09:57:04.152Z",
            "updated_at": "2023-12-04T19:19:34.039Z",
            "host": "8.8.8.8:80"
        }
    ],
    "absoluteTotal": 24,
    "perPage": 10
}
```

--------------------------------

### PUT /api/detection_engine/rules/prepackaged

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-installprebuiltrulesandtimelines

Install and update all Elastic prebuilt detection rules and Timelines. This endpoint installs any new prebuilt detection rules and Timelines not currently in your system, and updates any existing ones that have been modified or improved by Elastic.

```APIDOC
## PUT /api/detection_engine/rules/prepackaged

### Description
Install and update all Elastic prebuilt detection rules and Timelines. This endpoint ensures your detection engine is up-to-date with the latest rules and Timelines provided by Elastic.

### Method
PUT

### Endpoint
/api/detection_engine/rules/prepackaged

### Spaces Support
put /s/{space_id}/api/detection_engine/rules/prepackaged

### Authentication
- API Key Authentication
- Basic Authentication

### Parameters
None

### Request Example
```
curl \
 --request PUT 'https://localhost:5601/api/detection_engine/rules/prepackaged' \
 --header "Authorization: $API_KEY"
```

### Response
#### Success Response (200)
- **rules_installed** (integer) - Required - The number of rules installed (minimum value: 0)
- **rules_updated** (integer) - Required - The number of rules updated (minimum value: 0)
- **timelines_installed** (integer) - Required - The number of timelines installed (minimum value: 0)
- **timelines_updated** (integer) - Required - The number of timelines updated (minimum value: 0)

#### Response Example
```
{
  "rules_updated": 0,
  "rules_installed": 112,
  "timelines_updated": 2,
  "timelines_installed": 5
}
```

### Functionality
When you call this endpoint, it will:
- Install any new prebuilt detection rules not currently installed in your system
- Update any existing prebuilt detection rules that have been modified or improved by Elastic
- Install any new prebuilt Timelines not currently installed in your system
- Update any existing prebuilt Timelines that have been modified or improved by Elastic
```

--------------------------------

### POST /api/fleet/epm/packages

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-epm-packages

Installs a package by uploading a compressed file (gzip or zip) containing the package details. This endpoint supports API key and Basic authentication and requires specific route privileges.

```APIDOC
## POST /api/fleet/epm/packages

### Description
Installs a package by uploading a compressed file (gzip or zip) containing the package details. This endpoint supports API key and Basic authentication and requires specific route privileges.

### Method
POST

### Endpoint
/api/fleet/epm/packages

### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks

### Query Parameters
- **ignoreMappingUpdateErrors** (boolean) - Optional - Default value is `false`.
- **skipDataStreamRollover** (boolean) - Optional - Default value is `false`.

### Request Body
- The request body should be a binary string (gzip or zip).

### Request Example
```curl
curl \
 --request POST 'https://localhost:5601/api/fleet/epm/packages' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/gzip; application/zip" \
 --header "kbn-xsrf: true" \
 --data-binary '@file'
```

### Responses
#### Success Response (200)
- **_meta** (object) - Required - Additional properties are NOT allowed.
  - **install_source** (string) - Required
  - **name** (string) - Required
- **items** (array[object]) - Required
  - **deferred** (boolean)
  - **id** (string) - Required
  - **originId** (string)
  - **type** (string) - Required - Any of: `dashboard`, `lens`, `visualization`, `search`, `index-pattern`, `map`, `ml-module`, `security-rule`, `csp-rule-template`, `osquery-pack-asset`, `osquery-saved-query`, or `tag`.
  - **deferred** (boolean)
  - **id** (string) - Required
  - **type** (string) - Required - Any of: `index`, `index_template`, `component_template`, `ingest_pipeline`, `ilm_policy`, `data_stream_ilm_policy`, `transform`, `ml_model`, or `knowledge_base`.
  - **version** (string)

#### Error Response (400)
- **error** (string)
- **errorType** (string)
- **message** (string) - Required
- **statusCode** (number)
```

--------------------------------

### Start an Entity Engine - POST Request

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-startentityengine

Initiates an Entity Engine for a specified entity type (user, host, service, or generic). Returns a successful response with a boolean started status. Requires API key or basic authentication.

```curl
curl \
 --request POST 'https://localhost:5601/api/entity_store/engines/{entityType}/start' \
 --header "Authorization: $API_KEY"
```

--------------------------------

### GET Privileged Access Detection Status - cURL

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-getprivilegedaccessdetectionpackagestatus

Retrieves the current status of the privileged access detection package for Entity Analytics privileged user monitoring. Returns job information, ML module setup status, and package installation status. Requires API key authentication.

```bash
curl \
 --request GET 'https://localhost:5601/api/entity_analytics/privileged_user_monitoring/pad/status' \
 --header "Authorization: $API_KEY"
```

--------------------------------

### Request Body Examples for Connector Actions

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-actions-connector-id-execute

Provides JSON examples for the request body when executing Kibana connector actions. These examples illustrate different 'params' and 'subActionParams' structures for various operations like sending documents, getting choices, or posting messages.

```json
{
  "params": {
    "documents": [
      {
        "id": "my_doc_id",
        "name": "my_doc_name",
        "message": "hello, world"
      }
    ]
  }
}
```

```json
{
  "params": {
    "subAction": "issueTypes"
  }
}
```

```json
{
  "params": {
    "subAction": "getChoices",
    "subActionParams": {
      "fields": [
        "severity",
        "urgency"
      ]
    }
  }
}
```

```json
{
  "params": {
    "subAction": "postMessage",
    "subActionParams": {
      "text": "A test message.",
      "channelIds": [
        "C123ABC456"
      ]
    }
  }
}
```

```json
{
  "params": {
    "subAction": "pushToService",
    "subActionParams": {
      "comments": [
        {
          "comment": "A comment about the incident.",
          "commentId": 1
        }
      ],
      "incident": {
        "caseId": "1000",
        "caseName": "Case name",
        "description": "Description of the incident."
      }
    }
  }
}
```

--------------------------------

### MCP Server Initialization Request (curl)

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-agent-builder-mcp

Example of how to initialize the MCP server using a curl command. This demonstrates the POST request to the /api/agent_builder/mcp endpoint with necessary headers and JSON data. It includes API key authentication.

```curl
curl \
 --request POST 'https://localhost:5601/api/agent_builder/mcp' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"id":1,"method":"initialize","params":{"clientInfo":{"name":"test-client","version":"1.0.0"},"capabilities":{},"protocolVersion":"2024-11-05"},"jsonrpc":"2.0"}'
```

--------------------------------

### Get all data views response example - Kibana API

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-getalldataviewsdefault

Example JSON response from GET /api/data_views endpoint showing an array of data view objects with sample Kibana data (eCommerce, Flights, and Logs). Each data view includes id, name, title, typeMeta, and namespaces properties.

```json
{
  "data_view": [
    {
      "id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
      "name": "Kibana Sample Data eCommerce",
      "title": "kibana_sample_data_ecommerce",
      "typeMeta": {},
      "namespaces": [
        "default"
      ]
    },
    {
      "id": "d3d7af60-4c81-11e8-b3d7-01146121b73d",
      "name": "Kibana Sample Data Flights",
      "title": "kibana_sample_data_flights",
      "namespaces": [
        "default"
      ]
    },
    {
      "id": "90943e30-9a47-11e8-b64d-95841ca0b247",
      "name": "Kibana Sample Data Logs",
      "title": "kibana_sample_data_logs",
      "namespaces": [
        "default"
      ]
    }
  ]
}
```