Kibana#

Manage Elastic Kibana for observability, security, and infrastructure monitoring. Query data views, manage alerting rules, handle detection engine rules, manage Fleet agent policies, and work with cases and security alerts.

This skill uses ClawLink for hosted connection flows and credentials so you do not need to configure Kibana API access yourself.

Setup in 3 Steps#

Step 1: InstallStep 2: Pair AccountStep 3: Connect KibanaApp-specific connection GIF coming soon

How It Works#

text

┌─────────────────┐     ┌──────────────┐     ┌──────────────────┐
│   OpenClaw      │────▶│   ClawLink   │────▶│  Kibana REST API │
│   (User Chat)   │     │   (OAuth)    │     │   (v8.x)        │
└─────────────────┘     └──────────────┘     └──────────────────┘
         │                       │                       │
         │  1. Install Plugin  │                       │
         │  2. Pair Device   │                       │
         │  3. Connect Kibana │                      │
         │                   │  4. Secure Token      │
         │                   │  5. Proxy Requests    │
         │                   │                       │
         ▼                   ▼                       ▼
   ┌──────────┐      ┌──────────┐           ┌──────────┐
   │  SKILL   │      │ Dashboard│           │  Kibana  │
   │  File    │      │ Auth     │           │ Stack   │
   └──────────┘      └──────────┘           └──────────┘

Install#

Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Then tell the user: "OpenClaw has been restarted. Send /new as a standalone message to start a fresh chat, then ask for Kibana again."

Quick Start#

bash

# List data views
clawlink_call_tool --tool "kibana_get_data_views" --params '{}'

# Get alert types
clawlink_call_tool --tool "kibana_get_alert_types" --params '{}'

# List cases
clawlink_call_tool --tool "kibana_get_cases" --params '{}'

Authentication#

All Kibana tool calls are authenticated automatically by ClawLink using the user's connected Kibana instance.

No API key is required in chat. ClawLink stores the OAuth token securely and injects it into every Kibana API request on the user's behalf.

Getting Connected#

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with clawlink_begin_pairing if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=kibana and connect Kibana (requires an active Kibana instance).
4. Call clawlink_list_integrations to verify the connection is active.

Connection Management#

List Connections#

bash

clawlink_list_integrations

Response: Returns all connected integrations. Look for kibana in the list.

Verify Connection#

bash

clawlink_list_tools --integration kibana

Response: Returns the live tool catalog for Kibana.

Reconnect#

If Kibana tools are missing or the connection shows an error:

1. Direct the user to https://claw-link.dev/dashboard?add=kibana
2. After they confirm, call clawlink_list_integrations to verify
3. Then call clawlink_list_tools --integration kibana

Security & Permissions#

• Access is scoped to the connected Kibana instance only.
• All write operations require explicit user confirmation. Before executing any alerting, case, or Fleet action, confirm the target resource and intended effect with the user.
• Destructive actions (delete rule, delete saved object, delete connector) are marked as high-impact and must be confirmed.
• Fleet agent policy changes affect deployed agents — confirm before executing.
• Detection engine rule changes affect security monitoring — confirm before executing.

Tool Reference#

Data Views#

ToolDescriptionModekibana_get_data_viewsList all data views (index patterns) available in KibanaRead

Alerting#

ToolDescriptionModekibana_get_alert_typesGet available rule types with license requirements and configuration optionsReadkibana_get_alerting_rulesList alerting rules with pagination and filteringReadkibana_delete_alerting_rulesDelete an alerting rule by IDWrite

Actions & Connectors#

ToolDescriptionModekibana_get_action_typesGet available connector types (Slack, Email, Webhook, ServiceNow, etc.)Readkibana_get_connectorsList all configured connectorsReadkibana_delete_connectorsDelete a connector by IDWrite

Cases#

ToolDescriptionModekibana_get_casesList cases with optional filtering by status, assignee, or severityRead

Saved Objects#

ToolDescriptionModekibana_delete_saved_objectsDelete a saved object (visualization or dashboard) by IDWrite

Security Detection Engine#

ToolDescriptionModekibana_get_detection_engine_rules_findList detection engine rules with KQL filtering and sortingRead

Alerts#

ToolDescriptionModekibana_find_alertsFind and aggregate detection alerts with optional query filteringRead

Endpoint Exceptions#

ToolDescriptionModekibana_get_endpoint_list_itemsList Elastic Endpoint exception list items with filteringRead

Entity Store#

ToolDescriptionModekibana_get_entity_store_enginesGet entity store engine configurations and statusReadkibana_get_entity_store_entities_listList entity records (users, hosts, services) with paging and filteringReadkibana_get_entity_store_statusGet Entity Store status and configured enginesRead

Fleet#

ToolDescriptionModekibana_get_fleet_agent_policiesList Fleet agent policies with filtering and enrollment countsReadkibana_get_fleet_agents_available_versionsGet available Elastic Agent versionsReadkibana_get_fleet_agents_setup_statusCheck Fleet setup readiness and missing requirementsReadkibana_get_fleet_check_permissionsVerify user permissions for Fleet API operationsReadkibana_get_fleet_enrollment_api_keysList enrollment API keys for agent authenticationReadkibana_get_fleet_enrollment_api_keyGet details of a specific enrollment API key by IDReadkibana_delete_fleet_outputDelete a Fleet output configuration by IDWritekibana_delete_fleet_proxyDelete a Fleet proxy configuration by IDWrite

Fleet EPM (Elastic Package Manager)#

ToolDescriptionModekibana_get_fleet_epm_categoriesGet available package categories with countsReadkibana_get_fleet_epm_packagesList available Fleet integration packagesReadkibana_get_fleet_epm_packages_installedList installed Fleet packagesReadkibana_get_fleet_epm_package_detailsGet detailed package information including data streams and assetsReadkibana_get_fleet_epm_package_statsGet usage statistics for a specific Fleet packageReadkibana_get_fleet_epm_package_fileGet a specific file from an EPM package (manifest, README, changelog)Readkibana_get_fleet_epm_data_streamsList available data streams with filteringRead

Lists#

ToolDescriptionModekibana_delete_listDelete a list by IDWrite

Osquery#

ToolDescriptionModekibana_delete_osquery_saved_queriesDelete an Osquery saved query by saved object IDWrite

Code Examples#

List data views#

bash

clawlink_call_tool --tool "kibana_get_data_views" \
  --params '{}'

Get alert types#

bash

clawlink_call_tool --tool "kibana_get_alert_types" \
  --params '{}'

List cases#

bash

clawlink_call_tool --tool "kibana_get_cases" \
  --params '{}'

Get detection engine rules#

bash

clawlink_call_tool --tool "kibana_get_detection_engine_rules_find" \
  --params '{"page": 1, "per_page": 25}'

Get Fleet agent policies#

bash

clawlink_call_tool --tool "kibana_get_fleet_agent_policies" \
  --params '{}'

Discovery Workflow#

1. Call clawlink_list_integrations to confirm Kibana is connected.
2. Call clawlink_list_tools --integration kibana to see the live catalog.
3. Treat the returned list as the source of truth. Do not guess or assume what tools exist.
4. If the user describes a capability but the exact tool is unclear, call clawlink_search_tools with a short query and integration kibana.
5. If no Kibana tools appear, direct the user to https://claw-link.dev/dashboard?add=kibana.

Execution Workflow#

text

┌─────────────────────────────────────────────────────────────┐
│  READ OPERATIONS (Safe)                                     │
│  list → get → search → describe → call                     │
│                                                             │
│  Example: List data views → Get index fields → Query data  │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  WRITE OPERATIONS (Require Confirmation)                     │
│  list → get → describe → preview → confirm → call          │
│                                                             │
│  Example: Preview rule delete → User approves → Execute     │
└─────────────────────────────────────────────────────────────┘

1. For unfamiliar tools, ambiguous requests, or any write action, call clawlink_describe_tool first.
2. Use the returned guidance, schema, whenToUse, askBefore, safeDefaults, examples, and followups to shape the call.
3. Prefer read, list, search, and get operations before writes when that reduces ambiguity.
4. For writes or anything marked as requiring confirmation, call clawlink_preview_tool first.
5. Execute with clawlink_call_tool. Pass confirmation only after the preview matches the user's intent.
6. If the tool call fails, report the real error. Do not invent results or restate the failure as a missing capability unless the live catalog supports that conclusion.

Notes#

• Alert types include Elasticsearch query alerts, index threshold alerts, machine learning anomaly detection, and security detection rules.
• Connector types (action types) include Slack, Email, Webhook, ServiceNow, and more — each with different license requirements.
• Fleet agent policies define configuration for groups of Elastic Agents including which integrations are enabled.
• Entity store aggregates and manages entity data (users, hosts, services) from various sources.
• Endpoint exception list contains security exceptions applied to Elastic Endpoint agents.
• Osquery saved queries require the saved_object_id (UUID format), not the custom id field.

Error Handling#

Status / ErrorMeaningTool not foundThe tool name does not exist in the current catalog. Verify with clawlink_list_tools --integration kibana.Missing connectionKibana is not connected. Direct the user to https://claw-link.dev/dashboard?add=kibana.Permission errorThe authenticated user lacks permission for this operation. Check Kibana roles.Fleet not readyFleet is not properly configured. Check setup status first.Write rejectedUser did not confirm a write action. Always confirm before executing writes.

Troubleshooting: Tools Not Visible#

1. Check that the ClawLink plugin is installed: bash

   openclaw plugins list
   
   

2. If the plugin is installed but tools are missing, tell the user to send /new as a standalone message to reload the catalog.

3. If a fresh chat does not help, run: bash

   openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
   openclaw gateway restart
   
   

4. After restart, tell the user to send /new again and retry.

Troubleshooting: Fleet Not Ready#

1. Check Fleet setup status: bash

   clawlink_call_tool --tool "kibana_get_fleet_agents_setup_status" --params '{}'
   
   

2. Review missing prerequisites and address them before managing agents or policies.

3. Verify Elasticsearch connection and license status.

Resources#

• Kibana Documentation
• Elastic Fleet Documentation
• Elastic Security Solution
• ClawLink: https://claw-link.dev/?utm_source=clawhub&utm_medium=referral&utm_content=kibana-observability
• ClawLink Docs: https://docs.claw-link.dev/openclaw
• ClawLink Verification: https://claw-link.dev/verify

Related Skills#

• New Relic Observability — For New Relic monitoring and alerting
• Make Automation — For Make.com workflow automation

---

Powered by ClawLink — an integration hub for OpenClaw