---
title: "Kibana integration for LuumenAI"
url: "https://www.luumen.ai/integrations/kibana/"
entity: SoftwareIntegration
category: "Databases & data platforms"
audience: "SRE, DevOps, platform engineering, IT operations"
---

# Kibana integration for LuumenAI

Read Kibana alerts, rules, and cases, then make changes as approved steps

## What LuumenAI can do with Kibana

LuumenAI connects to Kibana with Basic auth and exposes 47 tools (34 read-only · 6 write · 7 destructive). Reads answer immediately; writes are shown as a plan and require approval by default, configurable per tool by an administrator.

## Key facts

- Authentication: Basic auth
- Tools available: 47 tools (34 read-only · 6 write · 7 destructive)
- Plan: available on all plans
- Category: Databases & data platforms

## About Kibana with LuumenAI

Connect Kibana and your agent can read what your detection and observability stack is doing: alerting rules, detection engine rules, open cases, connectors, and data views. When something needs to change — a new alerting rule, a case opened for an incident, a stale rule removed — the agent shows the exact call first and waits for your approval. Luumen signs in with basic authentication.

## Example tools

Read-only (34 in total):

- `KIBANA_FIND_ALERTS` — Find and/or aggregate detection alerts in Kibana.
- `KIBANA_GET_ACTION_TYPES` — Retrieves all available connector types (actions) in Kibana.
- `KIBANA_GET_ALERTING_RULES` — Retrieve a list of alerting rules in Kibana.
- `KIBANA_GET_ALERT_TYPES` — Retrieves available rule types (alert types) in Kibana.
- `KIBANA_GET_CASES` — Retrieve a list of cases in Kibana.
- `KIBANA_GET_CONNECTORS` — Retrieve a list of all connectors in Kibana.
- `KIBANA_GET_DATA_VIEWS` — Retrieves all data views (formerly known as index patterns) available in Kibana.
- `KIBANA_GET_DETECTION_ENGINE_RULES_FIND` — Retrieves a paginated list of Kibana detection engine rules with flexible filtering and sorting options.

Write and destructive (13 in total, approval required by default):

- `KIBANA_DELETE_ALERTING_RULES` — Delete an alerting rule in Kibana.
- `KIBANA_DELETE_CONNECTORS` — Delete a connector in Kibana.
- `KIBANA_DELETE_FLEET_OUTPUT` — Delete a specific output configuration in Kibana Fleet.
- `KIBANA_DELETE_FLEET_PROXY` — Deletes a Fleet proxy configuration by its unique identifier.
- `KIBANA_DELETE_LIST` — Deletes a list.
- `KIBANA_DELETE_OSQUERY_SAVED_QUERIES` — Delete a saved Osquery query by its saved object ID.
- `KIBANA_DELETE_SAVED_OBJECTS` — Delete a saved object in Kibana.
- `KIBANA_POST_ALERTING_RULES` — Create a new alerting rule in Kibana.

## Frequently asked questions

### How does LuumenAI connect to Kibana?

Authorize once with Basic auth. Luumen lists the scopes each action needs before you approve the connection, and credentials never appear in the chat.

### Can LuumenAI change things in Kibana on its own?

Read actions answer immediately. Anything that writes is shown as a plan and requires approval by default, including the 7 actions classified as destructive. Administrators configure that per tool.

### Is there an audit trail?

Every call to Kibana — read or write, approved or declined — is recorded with the actor, the input, and the result.

Full page: https://www.luumen.ai/integrations/kibana/