siren_investigate (5.6.10)

SIREn Solutions : info@siren.io License: SEE LICENSE IN LICENSE.md

Siren Investigate extends Kibana with data intelligence features. At the core, Investigate can join and filter data live from multiple indexes (elasticsearch) or from SQL/NOSQL sources. Kibana is a trademark of Elasticsearch BV, registered in the U.S. and in other countries.

Api version - v1

CreateObjectDefinition

API to create an object definition

Authorizations:

basicAuth

path Parameters

type

required

string (ObjectDefinitionType)

Enum: "search" "eid" "relation" "sirenapiscript" "dataspace"

The object definition type, e.g. search, eid, etc ...

query Parameters

dataspace

string

Request Body schema: application/json
required

Any of

required

object (SavedSearchAttributes)

version

required

number <integer>

Value: 106

Search object version

compositePrimaryKeyFields

required

Array of strings <keyword> (keyword) [ items <keyword > ]

required

object

object (EntityResolutionV106)

enabled

required

boolean

Whether this search represents an entity resolution Entity Table.

required

Array of objects (DynamicFilterMappingV106)

Array

filterId required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
field required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

required

object

required	Array of objects (PerspectiveInfoV103) Record table, can be an empty array
required	Array of objects (PerspectiveInfoV103) Record view, can be an empty array

required

object (GlobalSearchSettingsV106)

selectedByDefault required	boolean <boolean> Is the Entity table selected by default in searches
forceSearchedOnTimeFilter required	boolean <boolean> Should include documents that do not contain a timefield in search results, if there is a time filter applied.
	Array of objects (GlobalSearchRecencyBoostRangeV106) Global search boost configuration for recent records
boost required	number <double> (double) A double-precision 64-bit IEEE 754 floating point number, restricted to finite values.
enabled required	boolean <boolean> Property to enable/disable globalSearch

object

fields

required

string <string>

Fields name

object (RevisionSettingsV106)

copyToFields	object
indexingScope required	string (IndexingScopeStringV106) Enum: "G:S" "G:NS" "L" "N"
editableFieldsExceptions required	Array of strings Field name exceptions list
editableFieldsMode required	string (EditableFieldsModeV106) Enum: "whitelist" "blacklist"
primaryKey required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
isEditable required	boolean <boolean> Property to enable/disable revision
index required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object

maxJoinCardinalityApplyToTarget	boolean <boolean> Property to apply max join cardinality to target
maxJoinCardinalityApplyToSource	boolean <boolean> Property to apply max join cardinality to source
maxJoinCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxJoinCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxJoinCardinalityEnabled	boolean <boolean> Property to enable max join cardinality required when maxJoinCardinality or maxJoinCardinalityUnit are defined
maxCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxCardinalityEnabled	boolean <boolean> Property to enable max cardinality required when maxCardinality or maxCardinalityUnit are defined
maxTimeRangeUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxTimeRange	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxTimeRangeEnabled	boolean <boolean> Property to enable max time range required when maxTimeRange or maxTimeRangeUnit are defined

required

object

instanceImageValue	string <string> Search instance image value
instanceImageType	string <string> Search instance image type
instanceLabelValue	string <string> Search instance label value
instanceLabelType	string <string> Search instance label type
shortDescription required	string <string> Short description
color required	string <string> Search icon color
icon required	string <string> Search icon to display

samplingScriptId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

indexingScope

string (IndexingScopeStringV106)

Enum: "G:S" "G:NS" "L" "N"

parentId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object (IndexPatternAttributesV106)

error	any
fieldFormatMap	string <string> Format maps for the search fields
excludeIndices	boolean <boolean> Is excluded indice true/false
sourceFilters	string <string> Source filters for the search
fields required	string <string> Stringified array having fields for search
intervalName	string <string> Interval name for the search
timeFieldName	string <string> non-empty Time field name for the search
pattern required	string <string> Index pattern name in elasticsearch

required

object

searchSourceJSON

required

string <string>

Stringified JSON object

sort

Array of strings

Sort string array

columns

Array of strings

Search columns name array

hits

number <integer> (integer)

A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.

description

string <string>

An optional description for search

title

required

string <string>

Title for search

isGlobal

boolean <boolean>

Is global true/false

version

string <string>

Version of document stored in Elasticsearch document meta

Responses

Request samples

Payload

Content type

application/json

Example

SavedSearchPayload

{"attributes": {"version": 106,
"compositePrimaryKeyFields": ["string"
],
"siren": {"entityResolution": {"enabled": true
},
"dynamicFilters": [{"filterId": "string",
"field": "string"
}
],
"templateScripts": {"recordTable": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
],
"recordView": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
]
},
"globalSearch": {"selectedByDefault": true,
"forceSearchedOnTimeFilter": true,
"recencyBoost": [{"boost": 0.1,
"from": {"count": 0.1,
"unit": "y"
}
}
],
"boost": 0.1,
"enabled": true
},
"highlight": {"fields": "string"
},
"revision": {"copyToFields": {"property1": ["string"
],
"property2": ["string"
]
},
"indexingScope": "G:S",
"editableFieldsExceptions": ["string"
],
"editableFieldsMode": "whitelist",
"primaryKey": "string",
"isEditable": true,
"index": "string"
},
"limits": {"maxJoinCardinalityApplyToTarget": true,
"maxJoinCardinalityApplyToSource": true,
"maxJoinCardinalityUnit": "string",
"maxJoinCardinality": 0,
"maxJoinCardinalityEnabled": true,
"maxCardinalityUnit": "string",
"maxCardinality": 0,
"maxCardinalityEnabled": true,
"maxTimeRangeUnit": "string",
"maxTimeRange": 0,
"maxTimeRangeEnabled": true
},
"ui": {"instanceImageValue": "string",
"instanceImageType": "string",
"instanceLabelValue": "string",
"instanceLabelType": "string",
"shortDescription": "string",
"color": "string",
"icon": "string"
},
"samplingScriptId": "string",
"indexingScope": "G:S",
"parentId": "string"
},
"indexPattern": {"error": null,
"fieldFormatMap": "string",
"excludeIndices": true,
"sourceFilters": "string",
"fields": "string",
"intervalName": "string",
"timeFieldName": "string",
"pattern": "string"
},
"kibanaSavedObjectMeta": {"searchSourceJSON": "string"
},
"sort": ["string"
],
"columns": ["string"
],
"hits": 0,
"description": "string",
"title": "string"
},
"isGlobal": true,
"version": "string"
}

Response samples

Content type

application/json

{"acknowledged": true,
"error": {"name": "string",
"message": "string",
"stack": "string"
},
"action": "string",
"status": 0,
"warning": "string",
"version": "string",
"attributes": null,
"namespace": "string",
"type": "string",
"id": "string"
}

CreateObjectDefinitionWithId

API to create an object definition with a specified id

Authorizations:

basicAuth

path Parameters

type required	string (ObjectDefinitionType) Enum: "search" "eid" "relation" "sirenapiscript" "dataspace" The object type, e.g. search, eid, etc ...
id required	string (ObjectDefinitionId) ^(?:([\w\d-]{1,25}):)?[2a-z_-]+:[\w\d-.()]+$ Example: search:a14c5675-1fdd-4bfb-804c-b2f67594656a The object id

query Parameters

dataspace	string
overwrite	boolean
__private	boolean

Request Body schema: application/json
required

Any of

required

object (SavedSearchAttributes)

version

required

number <integer>

Value: 106

Search object version

compositePrimaryKeyFields

required

Array of strings <keyword> (keyword) [ items <keyword > ]

required

object

object (EntityResolutionV106)

enabled

required

boolean

Whether this search represents an entity resolution Entity Table.

required

Array of objects (DynamicFilterMappingV106)

Array

filterId required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
field required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

required

object

required	Array of objects (PerspectiveInfoV103) Record table, can be an empty array
required	Array of objects (PerspectiveInfoV103) Record view, can be an empty array

required

object (GlobalSearchSettingsV106)

selectedByDefault required	boolean <boolean> Is the Entity table selected by default in searches
forceSearchedOnTimeFilter required	boolean <boolean> Should include documents that do not contain a timefield in search results, if there is a time filter applied.
	Array of objects (GlobalSearchRecencyBoostRangeV106) Global search boost configuration for recent records
boost required	number <double> (double) A double-precision 64-bit IEEE 754 floating point number, restricted to finite values.
enabled required	boolean <boolean> Property to enable/disable globalSearch

object

fields

required

string <string>

Fields name

object (RevisionSettingsV106)

copyToFields	object
indexingScope required	string (IndexingScopeStringV106) Enum: "G:S" "G:NS" "L" "N"
editableFieldsExceptions required	Array of strings Field name exceptions list
editableFieldsMode required	string (EditableFieldsModeV106) Enum: "whitelist" "blacklist"
primaryKey required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
isEditable required	boolean <boolean> Property to enable/disable revision
index required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object

maxJoinCardinalityApplyToTarget	boolean <boolean> Property to apply max join cardinality to target
maxJoinCardinalityApplyToSource	boolean <boolean> Property to apply max join cardinality to source
maxJoinCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxJoinCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxJoinCardinalityEnabled	boolean <boolean> Property to enable max join cardinality required when maxJoinCardinality or maxJoinCardinalityUnit are defined
maxCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxCardinalityEnabled	boolean <boolean> Property to enable max cardinality required when maxCardinality or maxCardinalityUnit are defined
maxTimeRangeUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxTimeRange	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxTimeRangeEnabled	boolean <boolean> Property to enable max time range required when maxTimeRange or maxTimeRangeUnit are defined

required

object

instanceImageValue	string <string> Search instance image value
instanceImageType	string <string> Search instance image type
instanceLabelValue	string <string> Search instance label value
instanceLabelType	string <string> Search instance label type
shortDescription required	string <string> Short description
color required	string <string> Search icon color
icon required	string <string> Search icon to display

samplingScriptId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

indexingScope

string (IndexingScopeStringV106)

Enum: "G:S" "G:NS" "L" "N"

parentId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object (IndexPatternAttributesV106)

error	any
fieldFormatMap	string <string> Format maps for the search fields
excludeIndices	boolean <boolean> Is excluded indice true/false
sourceFilters	string <string> Source filters for the search
fields required	string <string> Stringified array having fields for search
intervalName	string <string> Interval name for the search
timeFieldName	string <string> non-empty Time field name for the search
pattern required	string <string> Index pattern name in elasticsearch

required

object

searchSourceJSON

required

string <string>

Stringified JSON object

sort

Array of strings

Sort string array

columns

Array of strings

Search columns name array

hits

number <integer> (integer)

A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.

description

string <string>

An optional description for search

title

required

string <string>

Title for search

isGlobal

boolean <boolean>

Is global true/false

version

string <string>

Version of document stored in Elasticsearch document meta

Responses

Request samples

Payload

Content type

application/json

Example

SavedSearchPayload

{"attributes": {"version": 106,
"compositePrimaryKeyFields": ["string"
],
"siren": {"entityResolution": {"enabled": true
},
"dynamicFilters": [{"filterId": "string",
"field": "string"
}
],
"templateScripts": {"recordTable": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
],
"recordView": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
]
},
"globalSearch": {"selectedByDefault": true,
"forceSearchedOnTimeFilter": true,
"recencyBoost": [{"boost": 0.1,
"from": {"count": 0.1,
"unit": "y"
}
}
],
"boost": 0.1,
"enabled": true
},
"highlight": {"fields": "string"
},
"revision": {"copyToFields": {"property1": ["string"
],
"property2": ["string"
]
},
"indexingScope": "G:S",
"editableFieldsExceptions": ["string"
],
"editableFieldsMode": "whitelist",
"primaryKey": "string",
"isEditable": true,
"index": "string"
},
"limits": {"maxJoinCardinalityApplyToTarget": true,
"maxJoinCardinalityApplyToSource": true,
"maxJoinCardinalityUnit": "string",
"maxJoinCardinality": 0,
"maxJoinCardinalityEnabled": true,
"maxCardinalityUnit": "string",
"maxCardinality": 0,
"maxCardinalityEnabled": true,
"maxTimeRangeUnit": "string",
"maxTimeRange": 0,
"maxTimeRangeEnabled": true
},
"ui": {"instanceImageValue": "string",
"instanceImageType": "string",
"instanceLabelValue": "string",
"instanceLabelType": "string",
"shortDescription": "string",
"color": "string",
"icon": "string"
},
"samplingScriptId": "string",
"indexingScope": "G:S",
"parentId": "string"
},
"indexPattern": {"error": null,
"fieldFormatMap": "string",
"excludeIndices": true,
"sourceFilters": "string",
"fields": "string",
"intervalName": "string",
"timeFieldName": "string",
"pattern": "string"
},
"kibanaSavedObjectMeta": {"searchSourceJSON": "string"
},
"sort": ["string"
],
"columns": ["string"
],
"hits": 0,
"description": "string",
"title": "string"
},
"isGlobal": true,
"version": "string"
}

Response samples

Content type

application/json

{"acknowledged": true,
"error": {"name": "string",
"message": "string",
"stack": "string"
},
"action": "string",
"status": 0,
"warning": "string",
"version": "string",
"attributes": null,
"namespace": "string",
"type": "string",
"id": "string"
}

UpdateObjectDefinition

API to update an object definition with a specific id

Authorizations:

basicAuth

path Parameters

type required	string (ObjectDefinitionType) Enum: "search" "eid" "relation" "sirenapiscript" "dataspace" The object definition type, e.g. search, eid, etc ...
id required	string (ObjectDefinitionId) ^(?:([\w\d-]{1,25}):)?[2a-z_-]+:[\w\d-.()]+$ Example: search:a14c5675-1fdd-4bfb-804c-b2f67594656a The object definition id

query Parameters

dataspace

string

Request Body schema: application/json
required

Any of

required

object (SavedSearchAttributes)

version

required

number <integer>

Value: 106

Search object version

compositePrimaryKeyFields

required

Array of strings <keyword> (keyword) [ items <keyword > ]

required

object

object (EntityResolutionV106)

enabled

required

boolean

Whether this search represents an entity resolution Entity Table.

required

Array of objects (DynamicFilterMappingV106)

Array

filterId required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
field required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

required

object

required	Array of objects (PerspectiveInfoV103) Record table, can be an empty array
required	Array of objects (PerspectiveInfoV103) Record view, can be an empty array

required

object (GlobalSearchSettingsV106)

selectedByDefault required	boolean <boolean> Is the Entity table selected by default in searches
forceSearchedOnTimeFilter required	boolean <boolean> Should include documents that do not contain a timefield in search results, if there is a time filter applied.
	Array of objects (GlobalSearchRecencyBoostRangeV106) Global search boost configuration for recent records
boost required	number <double> (double) A double-precision 64-bit IEEE 754 floating point number, restricted to finite values.
enabled required	boolean <boolean> Property to enable/disable globalSearch

object

fields

required

string <string>

Fields name

object (RevisionSettingsV106)

copyToFields	object
indexingScope required	string (IndexingScopeStringV106) Enum: "G:S" "G:NS" "L" "N"
editableFieldsExceptions required	Array of strings Field name exceptions list
editableFieldsMode required	string (EditableFieldsModeV106) Enum: "whitelist" "blacklist"
primaryKey required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
isEditable required	boolean <boolean> Property to enable/disable revision
index required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object

maxJoinCardinalityApplyToTarget	boolean <boolean> Property to apply max join cardinality to target
maxJoinCardinalityApplyToSource	boolean <boolean> Property to apply max join cardinality to source
maxJoinCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxJoinCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxJoinCardinalityEnabled	boolean <boolean> Property to enable max join cardinality required when maxJoinCardinality or maxJoinCardinalityUnit are defined
maxCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxCardinalityEnabled	boolean <boolean> Property to enable max cardinality required when maxCardinality or maxCardinalityUnit are defined
maxTimeRangeUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxTimeRange	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxTimeRangeEnabled	boolean <boolean> Property to enable max time range required when maxTimeRange or maxTimeRangeUnit are defined

required

object

instanceImageValue	string <string> Search instance image value
instanceImageType	string <string> Search instance image type
instanceLabelValue	string <string> Search instance label value
instanceLabelType	string <string> Search instance label type
shortDescription required	string <string> Short description
color required	string <string> Search icon color
icon required	string <string> Search icon to display

samplingScriptId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

indexingScope

string (IndexingScopeStringV106)

Enum: "G:S" "G:NS" "L" "N"

parentId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object (IndexPatternAttributesV106)

error	any
fieldFormatMap	string <string> Format maps for the search fields
excludeIndices	boolean <boolean> Is excluded indice true/false
sourceFilters	string <string> Source filters for the search
fields required	string <string> Stringified array having fields for search
intervalName	string <string> Interval name for the search
timeFieldName	string <string> non-empty Time field name for the search
pattern required	string <string> Index pattern name in elasticsearch

required

object

searchSourceJSON

required

string <string>

Stringified JSON object

sort

Array of strings

Sort string array

columns

Array of strings

Search columns name array

hits

number <integer> (integer)

A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.

description

string <string>

An optional description for search

title

required

string <string>

Title for search

isGlobal

boolean <boolean>

Is global true/false

version

string <string>

Version of document stored in Elasticsearch document meta

Responses

Request samples

Payload

Content type

application/json

Example

SavedSearchPayload

{"attributes": {"version": 106,
"compositePrimaryKeyFields": ["string"
],
"siren": {"entityResolution": {"enabled": true
},
"dynamicFilters": [{"filterId": "string",
"field": "string"
}
],
"templateScripts": {"recordTable": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
],
"recordView": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
]
},
"globalSearch": {"selectedByDefault": true,
"forceSearchedOnTimeFilter": true,
"recencyBoost": [{"boost": 0.1,
"from": {"count": 0.1,
"unit": "y"
}
}
],
"boost": 0.1,
"enabled": true
},
"highlight": {"fields": "string"
},
"revision": {"copyToFields": {"property1": ["string"
],
"property2": ["string"
]
},
"indexingScope": "G:S",
"editableFieldsExceptions": ["string"
],
"editableFieldsMode": "whitelist",
"primaryKey": "string",
"isEditable": true,
"index": "string"
},
"limits": {"maxJoinCardinalityApplyToTarget": true,
"maxJoinCardinalityApplyToSource": true,
"maxJoinCardinalityUnit": "string",
"maxJoinCardinality": 0,
"maxJoinCardinalityEnabled": true,
"maxCardinalityUnit": "string",
"maxCardinality": 0,
"maxCardinalityEnabled": true,
"maxTimeRangeUnit": "string",
"maxTimeRange": 0,
"maxTimeRangeEnabled": true
},
"ui": {"instanceImageValue": "string",
"instanceImageType": "string",
"instanceLabelValue": "string",
"instanceLabelType": "string",
"shortDescription": "string",
"color": "string",
"icon": "string"
},
"samplingScriptId": "string",
"indexingScope": "G:S",
"parentId": "string"
},
"indexPattern": {"error": null,
"fieldFormatMap": "string",
"excludeIndices": true,
"sourceFilters": "string",
"fields": "string",
"intervalName": "string",
"timeFieldName": "string",
"pattern": "string"
},
"kibanaSavedObjectMeta": {"searchSourceJSON": "string"
},
"sort": ["string"
],
"columns": ["string"
],
"hits": 0,
"description": "string",
"title": "string"
},
"isGlobal": true,
"version": "string"
}

Response samples

Content type

application/json

{"acknowledged": true,
"error": {"name": "string",
"message": "string",
"stack": "string"
},
"action": "string",
"status": 0,
"warning": "string",
"version": "string",
"attributes": null,
"namespace": "string",
"type": "string",
"id": "string"
}

DeleteObjectDefinition

Authorizations:

basicAuth

path Parameters

required

string (ObjectDefinitionId) ^(?:([\w\d-]{1,25}):)?[2a-z_-]+:[\w\d-.()]+$

Example: search:a14c5675-1fdd-4bfb-804c-b2f67594656a

An investigate object stringified id with the following format [DataspaceShortcode:]InvestigateObject:UUID.

Responses

Response samples

Content type

application/json

{"deletedIds": ["string"
],
"acknowledged": true
}

ValidateObjectDefinition

API to validate an object definition

Authorizations:

basicAuth

path Parameters

type

required

string (ObjectDefinitionType)

Enum: "search" "eid" "relation" "sirenapiscript" "dataspace"

The object definition type, e.g. search, eid, etc ...

query Parameters

id	string (ObjectDefinitionId) ^(?:([\w\d-]{1,25}):)?[2a-z_-]+:[\w\d-.()]+$ Example: id=search:a14c5675-1fdd-4bfb-804c-b2f67594656a An investigate object stringified id with the following format [DataspaceShortcode:]InvestigateObject:UUID.

Request Body schema: application/json
required

Any of

required

object (SavedSearchAttributes)

version

required

number <integer>

Value: 106

Search object version

compositePrimaryKeyFields

required

Array of strings <keyword> (keyword) [ items <keyword > ]

required

object

object (EntityResolutionV106)

enabled

required

boolean

Whether this search represents an entity resolution Entity Table.

required

Array of objects (DynamicFilterMappingV106)

Array

filterId required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
field required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

required

object

required	Array of objects (PerspectiveInfoV103) Record table, can be an empty array
required	Array of objects (PerspectiveInfoV103) Record view, can be an empty array

required

object (GlobalSearchSettingsV106)

selectedByDefault required	boolean <boolean> Is the Entity table selected by default in searches
forceSearchedOnTimeFilter required	boolean <boolean> Should include documents that do not contain a timefield in search results, if there is a time filter applied.
	Array of objects (GlobalSearchRecencyBoostRangeV106) Global search boost configuration for recent records
boost required	number <double> (double) A double-precision 64-bit IEEE 754 floating point number, restricted to finite values.
enabled required	boolean <boolean> Property to enable/disable globalSearch

object

fields

required

string <string>

Fields name

object (RevisionSettingsV106)

copyToFields	object
indexingScope required	string (IndexingScopeStringV106) Enum: "G:S" "G:NS" "L" "N"
editableFieldsExceptions required	Array of strings Field name exceptions list
editableFieldsMode required	string (EditableFieldsModeV106) Enum: "whitelist" "blacklist"
primaryKey required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
isEditable required	boolean <boolean> Property to enable/disable revision
index required	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object

maxJoinCardinalityApplyToTarget	boolean <boolean> Property to apply max join cardinality to target
maxJoinCardinalityApplyToSource	boolean <boolean> Property to apply max join cardinality to source
maxJoinCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxJoinCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxJoinCardinalityEnabled	boolean <boolean> Property to enable max join cardinality required when maxJoinCardinality or maxJoinCardinalityUnit are defined
maxCardinalityUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxCardinality	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxCardinalityEnabled	boolean <boolean> Property to enable max cardinality required when maxCardinality or maxCardinalityUnit are defined
maxTimeRangeUnit	string <keyword> (keyword) A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.
maxTimeRange	number <integer> (integer) A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.
maxTimeRangeEnabled	boolean <boolean> Property to enable max time range required when maxTimeRange or maxTimeRangeUnit are defined

required

object

instanceImageValue	string <string> Search instance image value
instanceImageType	string <string> Search instance image type
instanceLabelValue	string <string> Search instance label value
instanceLabelType	string <string> Search instance label type
shortDescription required	string <string> Short description
color required	string <string> Search icon color
icon required	string <string> Search icon to display

samplingScriptId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

indexingScope

string (IndexingScopeStringV106)

Enum: "G:S" "G:NS" "L" "N"

parentId

string <keyword> (keyword)

A string mapped as keyword. This will not be analyzed before it’s stored into the inverted index.

object (IndexPatternAttributesV106)

error	any
fieldFormatMap	string <string> Format maps for the search fields
excludeIndices	boolean <boolean> Is excluded indice true/false
sourceFilters	string <string> Source filters for the search
fields required	string <string> Stringified array having fields for search
intervalName	string <string> Interval name for the search
timeFieldName	string <string> non-empty Time field name for the search
pattern required	string <string> Index pattern name in elasticsearch

required

object

searchSourceJSON

required

string <string>

Stringified JSON object

sort

Array of strings

Sort string array

columns

Array of strings

Search columns name array

hits

number <integer> (integer)

A signed 32-bit integer with a minimum value of -231 and a maximum value of 231-1.

description

string <string>

An optional description for search

title

required

string <string>

Title for search

isGlobal

boolean <boolean>

Is global true/false

version

string <string>

Version of document stored in Elasticsearch document meta

Responses

Request samples

Payload

Content type

application/json

Example

SavedSearchPayload

{"attributes": {"version": 106,
"compositePrimaryKeyFields": ["string"
],
"siren": {"entityResolution": {"enabled": true
},
"dynamicFilters": [{"filterId": "string",
"field": "string"
}
],
"templateScripts": {"recordTable": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
],
"recordView": [{"type": "view",
"perspective": "string",
"scriptId": "string"
}
]
},
"globalSearch": {"selectedByDefault": true,
"forceSearchedOnTimeFilter": true,
"recencyBoost": [{"boost": 0.1,
"from": {"count": 0.1,
"unit": "y"
}
}
],
"boost": 0.1,
"enabled": true
},
"highlight": {"fields": "string"
},
"revision": {"copyToFields": {"property1": ["string"
],
"property2": ["string"
]
},
"indexingScope": "G:S",
"editableFieldsExceptions": ["string"
],
"editableFieldsMode": "whitelist",
"primaryKey": "string",
"isEditable": true,
"index": "string"
},
"limits": {"maxJoinCardinalityApplyToTarget": true,
"maxJoinCardinalityApplyToSource": true,
"maxJoinCardinalityUnit": "string",
"maxJoinCardinality": 0,
"maxJoinCardinalityEnabled": true,
"maxCardinalityUnit": "string",
"maxCardinality": 0,
"maxCardinalityEnabled": true,
"maxTimeRangeUnit": "string",
"maxTimeRange": 0,
"maxTimeRangeEnabled": true
},
"ui": {"instanceImageValue": "string",
"instanceImageType": "string",
"instanceLabelValue": "string",
"instanceLabelType": "string",
"shortDescription": "string",
"color": "string",
"icon": "string"
},
"samplingScriptId": "string",
"indexingScope": "G:S",
"parentId": "string"
},
"indexPattern": {"error": null,
"fieldFormatMap": "string",
"excludeIndices": true,
"sourceFilters": "string",
"fields": "string",
"intervalName": "string",
"timeFieldName": "string",
"pattern": "string"
},
"kibanaSavedObjectMeta": {"searchSourceJSON": "string"
},
"sort": ["string"
],
"columns": ["string"
],
"hits": 0,
"description": "string",
"title": "string"
},
"isGlobal": true,
"version": "string"
}

Response samples

Content type

application/json

{"acknowledged": true,
"error": {"name": "string",
"message": "string",
"stack": "string"
},
"action": "string",
"status": 0,
"warning": "string",
"version": "string",
"attributes": null,
"namespace": "string",
"type": "string",
"id": "string"
}

siren_investigate (5.6.10)

Api version - v1

CreateObjectDefinition

Authorizations:

path Parameters

query Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

CreateObjectDefinitionWithId

Authorizations:

path Parameters

query Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

UpdateObjectDefinition

Authorizations:

path Parameters

query Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

DeleteObjectDefinition

Authorizations:

path Parameters

Responses

Response samples

ValidateObjectDefinition

Authorizations:

path Parameters

query Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required