Bulk actions have been updated over time to have more capabilities, docs still have a select few.

[jamster10]

Description

Our documentation notes that

    .slack
    .email
    .pagerduty
    .webhook

are acceptable connectors for bulk actions but overttime we have increased its capability to:

Slack
Email
PagerDuty
Webhook
Microsoft Teams
IBM Resilient
Jira
ServiceNow
Swimlane

with new action_type_ids including:
.index
.jira
.resilient
.servicenow
.servicenow-itom
.servicenow-sir (ServiceNow SecOps)
.swimlane
.teams (Microsoft Teams)

Most of these are noted here: https://www.elastic.co/guide/en/security/current/rules-api-create.html#rules-api-create

But can we update the docs to provide the comprehensive list to our users.

Here is an image denoting the offerings the users currently have:

This is related to this SDH: https://github.com/elastic/sdh-security-team/issues/534

[lcawl]

This might be a good opportunity to talk about moving to open API specifications as the source of truth for API docs. I've been working through the responseOps API specs per elastic/kibana#137240 and am happy to chat further if the security dev teams are ready to begin down that path.

[nastasha-solomon]

@e40pud would you mind providing a list of accepted values for the action_type_id parameter that's available for the following endpoints:

• Create rule
• Update rule
• Bulk rule actions

Thank you!

[e40pud]

From what I can see in code, we have next connectors which are available for rule actions:

Name	ID
Slack Webhook	.slack
Slack Web API	.slack_api
Email	.email
Index	.index
PagerDuty	.pagerduty
Swimlane	.swimlane
Webhook	.webhook
ServiceNow ITSM	.servicenow
ServiceNow ITOM	.servicenow-itom
ServiceNow SecOps	.servicenow-sir
Jira	.jira
IBM Resilient	.resilient
Opsgenie	.opsgenie
Microsoft Teams	.teams
Torq	.torq
Tines	.tines
D3 Security	.d3security

There are few more connectors which are either experimental (Sentinel One, Case Management) or GenAI related (OpenAI, Amazon Bedrock). Also, I do not see Server Log (.server-log) and xMatters (.xmatters) being used within actions UI, but still available as connectors. @ymao1 @stephmilovic can you confirm that those are not used for rule actions at the moment?

[ymao1]

Yea, that list looks correct. Connectors available to the security form are registered with SecurityConnectorFeatureId and it looks like server log and xMatters are not registered with that feature ID.