Skip to main contentCrate elasticctl_api
Source pub use alerts::AlertHit;pub use alerts::AlertPage;pub use alerts::AlertStatus;pub use alerts::Conflicts;pub use alerts::SignalsOutcome;pub use alerts_ops::AlertFilter;pub use alerts_ops::AlertList;pub use alerts_ops::AssignPlan;pub use alerts_ops::EditReport;pub use alerts_ops::QueryStatusPlan;pub use alerts_ops::StatusPlan;pub use alerts_ops::StatusReport;pub use alerts_ops::TagsPlan;pub use cases::Case;pub use cases::CaseStatus;pub use cases::NewCase;pub use cases_ops::AttachGroup;pub use cases_ops::AttachPlan;pub use cases_ops::CaseEditReport;pub use cases_ops::CaseFilter;pub use cases_ops::CaseList;pub use cases_ops::CreatePlan;pub use cases_ops::DeletePlan;pub use cases_ops::StatusPlan as CaseStatusPlan;pub use codec::Format;pub use data_views_ops::DataViewDeletePlan;pub use data_views_ops::DataViewDeleteTarget;pub use data_views_ops::DataViewImportPlan;pub use data_views_ops::DataViewImportReport;pub use data_views_ops::DataViewPatch;pub use data_views_ops::DefaultPlan;pub use diff::Change;pub use diff::Drift;pub use diff::FieldChange;pub use exceptions::ListDetail;pub use exceptions::ListFilter;pub use exceptions::ListReport;pub use health::DoctorCheck;pub use health::DoctorReport;pub use health::InfoReport;pub use health::Status;pub use model::ExceptionItem;pub use model::ExceptionList;pub use model::ExceptionRef;pub use model::ExportSummary;pub use model::ITEM_VOLATILE_FIELDS;pub use model::LIST_VOLATILE_FIELDS;pub use model::ListKey;pub use model::Rule;pub use model::VOLATILE_FIELDS;pub use model::exception_refs;pub use model::server_defaults;pub use normalize::canonical;pub use normalize::comparable;pub use normalize::sort_rules;pub use ops::DeleteOutcome;pub use ops::ExportOutcome;pub use ops::ImportPlan;pub use ops::ImportReport;pub use ops::MutationPlan;pub use prebuilt::PrebuiltInstallOutcome;pub use prebuilt::PrebuiltStatus;pub use profiles::UserProfile;pub use report::ChangeReport;pub use report::ReportEntry;pub use rules::BulkAction;pub use rules::BulkOutcome;pub use rules::RuleFilter;pub use rules::RuleSource;pub use rules_ops::PreviewReport;pub use rules_ops::RuleListReport;pub use rules_ops::SetEnabledOutcome;pub use rules_ops::ValidateReport;pub use state::DanglingPointer;pub use state::DiffReport;pub use state::ExceptionDrift;pub use state::ListChange;pub use state::PullReport;pub use state::PushPlan;pub use state::PushReport;
- alerts
- Detection alerts: the signals search, status, tags, and assignees routes.
- alerts_ops
- Alert orchestration: filter construction, list/get, and the triage
mutation plans behind the CLI guard.
- cases
- Cases: typed wrappers over the
/api/cases family. - cases_ops
- Case orchestration: filters, list/get, and the guarded mutation plans.
- codec
- NDJSON and YAML representations of the same
Rule model. - content_codec
- Portable JSON and YAML sequence codecs.
- data_views
- Typed data-view models and public Kibana route wrappers.
- data_views_ops
- Data-view selection, portable normalization, and read orchestration.
- diff
- Field-level drift between desired local and live remote states.
- exceptions
- Typed wrappers for the exception-list API.
- health
- Health orchestration:
doctor and info. - model
- The rule, exception-list, and exception-item representations.
- normalize
- Deterministic rule forms.
- ops
- Report types shared across command verticals.
- prebuilt
- Prebuilt-rule status and installation (spec 4.6).
- profiles
- Username-to-profile-uid resolution for alert (and, in 0.4.1, case)
assignment.
- report
- Change evidence for a
push attached to a change ticket. - rules
- Typed wrappers for the detection-engine API.
- rules_ops
- Rules command orchestration, above the endpoint wrappers in
rules. - search
- Ad hoc data search: ES|QL and Query DSL.
- selection
- Resolve user-facing selectors to stable
rule_id values. - state
- State orchestration: pull, diff, and push.