@@ -16693,6 +16693,74 @@ paths:
1669316693 x-metaTags:
1669416694 - content: Kibana, Elastic Cloud Serverless
1669516695 name: product_name
16696+ /api/endpoint/action/memory_dump:
16697+ post:
16698+ description: |-
16699+ **Spaces method and path for this operation:**
16700+
16701+ <div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/endpoint/action/memory_dump</span></div>
16702+
16703+ Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
16704+
16705+ Generates memory dumps on the targeted host.
16706+ operationId: EndpointGenerateMemoryDump
16707+ requestBody:
16708+ content:
16709+ application/json:
16710+ examples:
16711+ ProcessMemoryDump:
16712+ summary: Generate a memory dump from the host machine
16713+ value:
16714+ agent_type: endpoint
16715+ comment: Generating memory dump for investigation
16716+ endpoint_ids:
16717+ - ed518850-681a-4d60-bb98-e22640cae2a8
16718+ parameters:
16719+ entity_id: abc123
16720+ type: process
16721+ schema:
16722+ $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDumpRouteRequestBody'
16723+ required: true
16724+ responses:
16725+ '200':
16726+ content:
16727+ application/json:
16728+ examples:
16729+ MemoryDumpSuccessResponse:
16730+ summary: Memory dump action successfully created
16731+ value:
16732+ data:
16733+ agents:
16734+ - ed518850-681a-4d60-bb98-e22640cae2a8
16735+ agentState:
16736+ ed518850-681a-4d60-bb98-e22640cae2a8:
16737+ isCompleted: false
16738+ wasSuccessful: false
16739+ agentType: endpoint
16740+ command: memory-dump
16741+ createdBy: elastic
16742+ hosts:
16743+ ed518850-681a-4d60-bb98-e22640cae2a8:
16744+ name: gke-node-1235412
16745+ id: 233db9ea-6733-4849-9226-5a7039c7161d
16746+ isCompleted: false
16747+ isExpired: false
16748+ outputs: {}
16749+ parameters:
16750+ entity_id: abc123
16751+ type: process
16752+ startedAt: '2022-07-29T19:08:49.126Z'
16753+ status: pending
16754+ wasSuccessful: false
16755+ schema:
16756+ $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
16757+ description: Action request was successfully created
16758+ summary: Generate a memory dump from the host machine
16759+ tags:
16760+ - Security Endpoint Management API
16761+ x-metaTags:
16762+ - content: Kibana, Elastic Cloud Serverless
16763+ name: product_name
1669616764 /api/endpoint/action/running_procs:
1669716765 post:
1669816766 description: |-
@@ -99976,6 +100044,7 @@ components:
99976100044 get-file: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
99977100045 isolate: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
99978100046 kill-process: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
100047+ memory-dump: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
99979100048 running-processes: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
99980100049 runscript: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
99981100050 scan: '#/components/schemas/Security_Endpoint_Management_API_Scan'
@@ -99995,6 +100064,7 @@ components:
99995100064 - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
99996100065 - $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
99997100066 - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
100067+ - $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
99998100068 Security_Endpoint_Management_API_ActionStateSuccessResponse:
99999100069 type: object
100000100070 properties:
@@ -100172,6 +100242,7 @@ components:
100172100242 - scan
100173100243 - runscript
100174100244 - cancel
100245+ - memory-dump
100175100246 minLength: 1
100176100247 type: string
100177100248 Security_Endpoint_Management_API_Commands:
@@ -100972,6 +101043,146 @@ components:
100972101043 - scriptName
100973101044 title: Microsoft Defender Endpoint Run Script Parameters
100974101045 type: object
101046+ Security_Endpoint_Management_API_MemoryDump:
101047+ allOf:
101048+ - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
101049+ - type: object
101050+ properties:
101051+ outputs:
101052+ additionalProperties:
101053+ type: object
101054+ properties:
101055+ content:
101056+ properties:
101057+ code:
101058+ type: string
101059+ disk_free_space:
101060+ description: The free space on the host machine in bytes after the memory dump is written to disk
101061+ type: number
101062+ file_size:
101063+ description: The size of the memory dump compressed file in bytes
101064+ type: string
101065+ path:
101066+ description: The path to the memory dump compressed file on the host machine
101067+ type: string
101068+ title: Memory dump output
101069+ type: object
101070+ type: object
101071+ parameters:
101072+ oneOf:
101073+ - properties:
101074+ type:
101075+ description: Kernel-level memory dump
101076+ enum:
101077+ - kernel
101078+ type: string
101079+ required:
101080+ - type
101081+ title: Kernel memory dump
101082+ type: object
101083+ - properties:
101084+ pid:
101085+ description: The process ID (PID)
101086+ type: number
101087+ type:
101088+ description: Process-level memory dump using a process ID
101089+ enum:
101090+ - process
101091+ type: string
101092+ required:
101093+ - type
101094+ - pid
101095+ title: Process memory dump with PID
101096+ type: object
101097+ - properties:
101098+ entity_id:
101099+ description: The process entity ID
101100+ type: string
101101+ type:
101102+ description: Process-level memory dump using an entity ID
101103+ enum:
101104+ - process
101105+ type: string
101106+ required:
101107+ - type
101108+ - entity_id
101109+ title: Process memory dump with entity ID
101110+ type: object
101111+ required:
101112+ - parameters
101113+ Security_Endpoint_Management_API_MemoryDumpRouteRequestBody:
101114+ allOf:
101115+ - type: object
101116+ properties:
101117+ agent_type:
101118+ $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
101119+ alert_ids:
101120+ description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts.
101121+ example:
101122+ - alert-id-1
101123+ - alert-id-2
101124+ items:
101125+ minLength: 1
101126+ type: string
101127+ minItems: 1
101128+ type: array
101129+ case_ids:
101130+ description: The IDs of cases where the action taken will be logged.
101131+ example:
101132+ - case-id-1
101133+ - case-id-2
101134+ items:
101135+ minLength: 1
101136+ type: string
101137+ minItems: 1
101138+ type: array
101139+ comment:
101140+ $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
101141+ endpoint_ids:
101142+ $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
101143+ parameters:
101144+ $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
101145+ required:
101146+ - endpoint_ids
101147+ - type: object
101148+ properties:
101149+ parameters:
101150+ oneOf:
101151+ - description: Dump the entire kernel memory.
101152+ type: object
101153+ properties:
101154+ type:
101155+ enum:
101156+ - kernel
101157+ type: string
101158+ required:
101159+ - type
101160+ - description: Dump the entire memory of a process using the PID.
101161+ type: object
101162+ properties:
101163+ pid:
101164+ type: number
101165+ type:
101166+ enum:
101167+ - process
101168+ type: string
101169+ required:
101170+ - type
101171+ - pid
101172+ - description: Dump the entire memory of a process using the entity ID.
101173+ type: object
101174+ properties:
101175+ entity_id:
101176+ type: string
101177+ type:
101178+ enum:
101179+ - process
101180+ type: string
101181+ required:
101182+ - type
101183+ - entity_id
101184+ required:
101185+ - parameters
100975101186 Security_Endpoint_Management_API_MetadataListResponse:
100976101187 example:
100977101188 data:
0 commit comments