# Kibana — how to use (mcp.ai)

Connect your Kibana account and use 47 tools for analytics straight from your AI agent. Connect with your own API key. Kibana is a visualization and analytics platform for Elasticsearch, offering dashboards, data exploration, and monitoring capabilities for gaining insights from data.

## Option A — via MCP (recommended)
Remote MCP endpoint (HTTP, streamable): `https://api.mcp.ai/p_kibana?ms=1787296080000`
Add it as a custom/remote MCP connector in your client (Claude, Cursor, VS Code…), then authenticate when prompted. Once connected, ask the agent to use the server's tools (e.g. `kibana_delete_alerting_rules`).

## Option B — via direct REST API
Base URL: `https://api.mcp.ai/api/kibana`
Auth: `Authorization: Bearer sk_live_…` — create a workspace API key at https://mcp.ai/settings/api-keys
Discover endpoints: `GET https://api.mcp.ai/api/kibana/_endpoints`

### Endpoints
- `POST https://api.mcp.ai/api/kibana/delete/alerting/rules` — Tool to delete an alerting rule in Kibana. Use when you need to remove a specific alerting rule by its ID.
  - body: { id: string, kbn_xsrf: string }
- `POST https://api.mcp.ai/api/kibana/delete/connectors` — Tool to delete a connector in Kibana. Use when you need to remove an existing connector.
  - body: { id: string, space_id?: string }
- `POST https://api.mcp.ai/api/kibana/delete/fleet/output` — Tool to delete a specific output configuration in Kibana Fleet. Use when you need to remove an existing output by its ID.
  - body: { kbn_xsrf?: string, output_id: string, elastic_api_version?: string }
- `POST https://api.mcp.ai/api/kibana/delete/fleet/proxy` — Deletes a Fleet proxy configuration by its unique identifier. Fleet proxies enable agents to communicate through proxy servers. Use this action to remove proxy configurations that are no longer needed
  - body: { kbnXsrf?: string, proxyId: string }
- `POST https://api.mcp.ai/api/kibana/delete/list` — Deletes a list. Use when you want to delete a list by its ID.
  - body: { id: string, delete_references?: boolean, ignore_references?: boolean }
- `POST https://api.mcp.ai/api/kibana/delete/osquery/saved/queries` — Delete a saved Osquery query by its saved object ID. Use this to remove a specific Osquery saved query from Kibana. IMPORTANT: This action requires the 'saved_object_id' (UUID format), not the custom 
  - body: { id: string }
- `POST https://api.mcp.ai/api/kibana/delete/saved/objects` — Tool to delete a saved object in Kibana. Use when you need to remove a specific saved object like a visualization or dashboard.
  - body: { id: string, type: string, force?: boolean, kbn_xsrf?: string }
- `POST https://api.mcp.ai/api/kibana/find/alerts` — Tool to find and/or aggregate detection alerts in Kibana. Use this to retrieve a list of alerts, optionally filtering them with a query and performing aggregations.
  - body: { aggs?: object, size?: integer, query?: object, runtime_mappings?: object }
- `POST https://api.mcp.ai/api/kibana/get/action/types` — Retrieves all available connector types (actions) in Kibana. Connector types (also called action types) are integrations like Slack, Email, Webhook, ServiceNow, etc. that can be used with alerting rul
- `POST https://api.mcp.ai/api/kibana/get/alert/types` — Retrieves available rule types (alert types) in Kibana. Returns comprehensive metadata about each rule type including: - Available action groups and variables for action templates - License requiremen
- `POST https://api.mcp.ai/api/kibana/get/alerting/rules` — Tool to retrieve a list of alerting rules in Kibana. Use when you need to get a paginated set of rules based on specified conditions.
  - body: { page?: integer, fields?: string[], filter?: string, search?: string, per_page?: integer, sort_field?: string, sort_order?: string, has_reference?: object, search_fields?: string[]|string, filter_consumers?: string[], default_search_operator?: string }
- `POST https://api.mcp.ai/api/kibana/get/cases` — Tool to retrieve a list of cases in Kibana. Use when you need to find or list existing security or operational cases, potentially filtering by various attributes like status, assignee, or severity.
  - body: { to?: string, from?: string, page?: integer, tags?: string[]|string, owner?: string[]|string, search?: string, status?: string, perPage?: integer, severity?: string, assignees?: string[]|string, reporters?: string[]|string, sortField?: string, sortOrder?: string, searchFields?: string[]|string, defaultSearchOperator?: string }
- `POST https://api.mcp.ai/api/kibana/get/connectors` — Tool to retrieve a list of all connectors in Kibana. Use this tool when you need to get information about available connectors.
  - body: { space_id?: string }
- `POST https://api.mcp.ai/api/kibana/get/data/views` — Retrieves all data views (formerly known as index patterns) available in Kibana. Data views define which Elasticsearch indices you want to explore and are used throughout Kibana for features like Disc
- `POST https://api.mcp.ai/api/kibana/get/detection/engine/rules/find` — Retrieves a paginated list of Kibana detection engine rules with flexible filtering and sorting options. Use this action to: - List all detection rules in your Kibana security solution - Search for sp
  - body: { page?: integer, fields?: string[], filter?: string, per_page?: integer, sort_field?: string, sort_order?: string, gaps_range_end?: string, gaps_range_start?: string }
- `POST https://api.mcp.ai/api/kibana/get/endpoint/list/items` — Retrieves Elastic Endpoint exception list items with filtering, pagination, and sorting capabilities. Use this action to: - List all endpoint exceptions in the security solution - Filter exceptions by
  - body: { page?: integer, filter?: string, per_page?: integer, sort_field?: string, sort_order?: string }
- `POST https://api.mcp.ai/api/kibana/get/entity/store/engines` — Retrieves all entity store engines configured in Kibana. Entity store engines aggregate and manage entity data for different entity types (user, host, service). This action returns detailed configurat
- `POST https://api.mcp.ai/api/kibana/get/entity/store/entities/list` — Tool to list entity records in the entity store with support for paging, sorting, and filtering. Use when you need to retrieve a list of entities such as users, hosts, or services.
  - body: { page?: integer, per_page?: integer, sort_field?: string, sort_order?: string, filterQuery?: string, entity_types: string[] }
- `POST https://api.mcp.ai/api/kibana/get/entity/store/status` — Retrieves the current status of the Kibana Entity Store and its configured engines. The Entity Store is a security feature that collects and organizes entity data (users, hosts, etc.) from various sou
- `POST https://api.mcp.ai/api/kibana/get/fleet/agent/policies` — Retrieves a paginated list of Fleet agent policies with filtering, sorting, and optional detailed information. Use this action to: - List all agent policies in your Fleet deployment - Filter policies 
  - body: { full?: boolean, page?: integer, kuery?: string, format?: string, perPage?: integer, sortField?: string, sortOrder?: string, withAgentCount?: boolean, showUpgradeable?: boolean }
- `POST https://api.mcp.ai/api/kibana/get/fleet/agents/available/versions` — Tool to retrieve the available versions for Fleet agents. Use when you need to get a list of all available Elastic Agent versions.
  - body: { elastic-api-version?: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/agents/setup/status` — Check Fleet setup readiness and identify missing requirements. Returns whether Fleet is ready (isReady), lists any missing prerequisites (missing_requirements), and shows optional feature availability
- `POST https://api.mcp.ai/api/kibana/get/fleet/check/permissions` — Tool to check the permissions for the Fleet API. Use when you need to verify if the current user has the necessary privileges for Fleet operations.
  - body: { fleetServerSetup?: boolean, elastic-api-version?: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/enrollment/api/key` — Tool to retrieve details of a specific enrollment API key by its ID. Use when you have the ID of an enrollment API key and need its details.
  - body: { key_id: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/enrollment/api/keys` — Tool to fetch a list of enrollment API keys. Use when you need to retrieve existing enrollment tokens for Kibana Fleet.
  - body: { page?: integer, kuery?: string, perPage?: integer }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/categories` — Get all available package categories in the Elastic Package Manager (EPM) with package counts. Returns categories like Security, Observability, Cloud, etc., along with the number of packages in each c
  - body: { prerelease?: boolean, elastic_api_version?: string, include_policy_templates?: boolean }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/data/streams` — Tool to retrieve the list of data streams in the Elastic Package Manager. Use when you need to get a list of available data streams, optionally filtering by type, dataset, or categorization.
  - body: { type?: string, sortOrder?: string, datasetQuery?: string, uncategorisedOnly?: boolean, elastic-api-version?: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/package/details` — Retrieves comprehensive details for a specific Fleet integration package version from the Elastic Package Manager (EPM). Returns detailed information including: - Package metadata (name, title, descri
  - body: { package_name: string, package_version: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/package/file` — Retrieves a specific file from an Elastic Package Manager (EPM) package. Use this to access package metadata, documentation, changelogs, or configuration files. Common use cases: inspecting manifest.y
  - body: { pkgName: string, filePath: string, pkgVersion: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/package/stats` — Retrieves usage statistics for a specific Fleet package in Kibana, including the number of package policies and agent policies using the package. Use this to understand package adoption and usage acro
  - body: { package_name: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/packages` — Tool to fetch the list of available packages in the Elastic Package Manager. Use when you need to find available integrations or their details.
  - body: { category?: string, prerelease?: boolean, excludeInstallStatus?: boolean, withPackagePoliciesCount?: boolean }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/packages/installed` — Tool to retrieve the list of installed packages in the Elastic Package Manager. Use this when you need to check which packages are currently installed in Fleet.
  - body: { perPage?: integer, searchAfter?: string[] }
- `POST https://api.mcp.ai/api/kibana/get/fleet/epm/packages/limited` — Retrieves a limited list of package names from the Elastic Package Manager (EPM) registry. Returns only package names (strings) without additional metadata, making it faster than the full packages end
- `POST https://api.mcp.ai/api/kibana/get/fleet/package/policies` — Retrieves a list of Fleet package policies (integration policies) in Kibana. Package policies define how integrations are configured and which agent policies they're associated with. Use this to list 
  - body: { page?: integer, kuery?: string, format?: string, perPage?: integer, sortField?: string, sortOrder?: string, withAgentCount?: boolean, showUpgradeable?: boolean }
- `POST https://api.mcp.ai/api/kibana/get/fleet/server/host` — Tool to fetch details of a specific Fleet server host by its item ID. Use when you need to get information about a particular Fleet Server host.
  - body: { host_id: string, elastic_api_version?: string }
- `POST https://api.mcp.ai/api/kibana/get/fleet/server/hosts` — Tool to retrieve the list of Fleet Server hosts. Use when you need to get information about the available Fleet Server hosts.
  - body: { page?: integer, perPage?: integer }
- `POST https://api.mcp.ai/api/kibana/get/index/management/indices` — Tool to fetch information about indices managed by Kibana's Index Management feature. It queries the underlying Elasticsearch /_cat/indices API to retrieve index details. Use when you need to list or 
  - body: { h?: string, s?: string, pri?: boolean, bytes?: string, index?: string, health?: string, expand_wildcards?: string }
- `POST https://api.mcp.ai/api/kibana/get/metrics` — Tool to retrieve statistics for nodes in an Elasticsearch cluster, often visualized in Kibana. Use when you need to monitor node health, performance, or resource usage. This action calls the Elasticse
  - body: { level?: string, types?: string, fields?: string, groups?: boolean, metric?: string, node_id?: string, timeout?: string, fielddata_fields?: string, completion_fields?: string, include_unloaded_segments?: boolean, include_segment_file_sizes?: boolean }
- `POST https://api.mcp.ai/api/kibana/get/reporting/jobs` — Tool to retrieve a list of reporting jobs in Kibana. Use when you need to see pending or completed reports. This uses an internal API endpoint, which might be subject to change without notice.
- `POST https://api.mcp.ai/api/kibana/get/saved/objects` — Tool to retrieve a list of saved objects in Kibana based on specified criteria. Use when you need to find dashboards, visualizations, index patterns, or other saved entities.
  - body: { page?: integer, type: string|string[], fields?: string[]|string, filter?: string, search?: string, per_page?: integer, space_id?: string, sort_field?: string, sort_order?: string, has_reference?: object, search_fields?: string[]|string, root_search_fields?: string[]|string, default_search_operator?: string }
- `POST https://api.mcp.ai/api/kibana/get/status` — Tool to get the current status of Kibana. Use when you need to check if Kibana is healthy, monitor its state, or get information about the Kibana instance including version, UUID, and metrics.
- `POST https://api.mcp.ai/api/kibana/post/alerting/rules` — Tool to create a new alerting rule in Kibana. Use when you need to define a new condition that, when met, triggers an alert and potentially executes predefined actions.
  - body: { name: string, tags?: string[], params: object, actions?: object[], enabled?: boolean, rule_id?: string, consumer: string, schedule: object, throttle?: string, notify_when: string, rule_type_id: string }
- `POST https://api.mcp.ai/api/kibana/post/cases` — Tool to create a new case in Kibana. Use when you need to open and track issues, incidents, or investigations. You can assign users, set severity levels, add tags, and configure external connectors fo
  - body: { tags?: string[], owner: string, title: string, category?: string, settings: object, severity?: string, assignees?: object[], connector: object, description: string, customFields?: object[] }
- `POST https://api.mcp.ai/api/kibana/post/connectors` — Tool to create a new connector in Kibana. Use when you need to integrate Kibana with an external service.
  - body: { id: string, name: string, config?: object, secrets?: object, kbn-xsrf?: string, connector_type_id: string }
- `POST https://api.mcp.ai/api/kibana/post/dashboards` — Tool to create a new dashboard in Kibana. Use when you need to create a dashboard to visualize data. Dashboards can contain visualizations, saved searches, and other embeddable objects. Note: When usi
  - body: { spaces?: string[], attributes: object, references?: object[], dashboard_id?: string }
- `POST https://api.mcp.ai/api/kibana/post/data/views` — Tool to create a new data view (index pattern) in Kibana. Use when you need to define which Elasticsearch indices to query and analyze in Kibana. Data views determine which fields are available in Dis
  - body: { override?: boolean, data_view: object }
- `POST https://api.mcp.ai/api/kibana/post/saved/objects` — Tool to create or update a saved object in Kibana. Use when you need to programmatically manage Kibana dashboards, visualizations, index patterns, etc.
  - body: { space_id?: string, object_id?: string, overwrite?: boolean, attributes: object, references?: object[], object_type: string }

## Example prompts
- "What can I do in Kibana?"
- "Show me a summary of my Kibana account"

## More
- Page: https://mcp.ai/kibana
- Agent spec (llms.txt): https://mcp.ai/kibana/llms.txt
- Postman collection: https://mcp.ai/kibana/postman.json