kibana_skill

Overview

This skill provides a managed Kibana API integration with injected authentication so you can programmatically manage saved objects, dashboards, data views, spaces, alerts, connectors, fleet, and security features. It proxies requests through a gateway that automatically supplies your Maton API key and enforces required headers. Use it to automate observability, security, and search-analytics workflows without handling low-level Kibana auth.

How this skill works

Requests are sent to the gateway base URL which forwards them to your Kibana instance while adding the Authorization header (Bearer MATON_API_KEY) and the required kbn-xsrf: true header. You can list, create, update, delete, and bulk-manage saved objects, data views, spaces, alert rules, connectors, fleet agents/policies, and roles by calling the corresponding Kibana native API paths under /kibana/{native-api-path}. Connection creation is handled via a control endpoint where you complete Kibana auth in a browser.

When to use it

• Automate backup, export, or bulk updates of dashboards and saved objects
• Manage data views and index pattern migrations programmatically
• Create or update spaces and multi-tenant configurations
• Query, enable/disable, or mute alerting rules from automation tooling
• Provision and manage Fleet agents, packages, and agent policies
• List and manage connectors (actions) and security roles via scripts or CI/CD

Best practices

• Store MATON_API_KEY securely in environment variables or a secrets manager
• Always include kbn-xsrf: true header on all requests
• Use pagination (page, per_page) and per_page limits to handle large result sets
• Test operations in a non-production Kibana space before applying changes globally
• Check Kibana privilege requirements for operations that modify security, fleet, or sensitive saved objects

Example use cases

• Export all dashboards and visualizations for backups or migrations using saved_objects/_find and _bulk_get
• Create or update data views programmatically when onboarding new indices
• Automate enabling/disabling or muting alert rules during maintenance windows
• Provision a new space for a team and pre-populate dashboards and role permissions
• List Fleet agent policies and update package integrations as part of deployment pipelines