added docs

docs/management/action-types.asciidoc

@@ -83,6 +83,10 @@ a| <<gen-ai-action-type,Generative AI>>
 
 | Send a request to OpenAI.
 
+a| <<d3security-action-type,D3 Security>>
+
+| Send a request to D3 Security.
+
 |===
 
 [NOTE]

docs/management/connectors/action-types/d3security.asciidoc

@@ -0,0 +1,87 @@
+[[d3security-action-type]]
+== D3 Security connector and action
+++++
+<titleabbrev>D3 Security</titleabbrev>
+++++
+
+The D3 Security connector uses https://github.com/axios/axios[axios] to send a POST request to a D3 Security endpoint. The connector uses the <<execute-connector-api,run connector API>> to send the request.
+
+[float]
+[[define-d3security-ui]]
+=== Create connectors in {kib}
+
+You can create connectors in *{stack-manage-app} > {connectors-ui}*.  For example:
+
+[role="screenshot"]
+image::management/connectors/images/d3security-connector.png[D3 Security connector]
+
+[float]
+[[d3security-connector-configuration]]
+==== Connector configuration
+
+D3 Security connectors have the following configuration properties:
+
+Name::      The name of the connector.
+URL::   The D3 Security API request URL.
+Token::   The D3 Security token
+
+To generate an API URL and a token in D3 Security:
+1. Log in to your D3 SOAR environment.
+2. Navigate to Configuration.
+3. Navigate to Integration > Search for “Kibana”. Click “Fetch Event”.
+4. Select the "Enable Webhook" checkbox.
+5. Click Set up Webhook Keys.
+6. Under Event Ingestion, Click +. Select the site for the webhook integration, then click Generate.
+7. Copy the Request URL and Request Header Value to configure the Kibana connector
+
+[float]
+[[preconfigured-d3security-configuration]]
+=== Create preconfigured connectors
+
+If you are running {kib} on-prem, you can define connectors by
+adding `xpack.actions.preconfigured` settings to your `kibana.yml` file.
+For example:
+
+[source,text]
+--
+xpack.actions.preconfigured:
+  my-d3security:
+    name: preconfigured-d3security-connector-type
+    actionTypeId: .d3security
+    config:
+      url: https://testurl.com/elasticsearch/VSOC/api/Data/Kibana/Security%20Operations/CreateEvents
+    secrets:
+      token: superlongtoken
+--
+
+Config defines information for the connector type.
+
+`url`:: A URL string that corresponds to the *D3 Security API URL*.
+
+Secrets defines sensitive information for the connector type.
+
+`token`:: A string that corresponds to *D3 Security API Token*.
+
+[float]
+[[d3security-action-configuration]]
+=== Test connectors
+
+You can test connectors with the <<execute-connector-api,run connector API>> or
+as you're creating or editing the connector in {kib}. For example:
+
+[role="screenshot"]
+image::management/connectors/images/d3security-params-test.png[D3 Security params test]
+
+The D3 Security actions have the following configuration properties.
+
+Body::      A typeless payload sent to the D3 Security API URL. For example:
++
+[source,text]
+--
+this can be any type, it is not validated
+--
+[float]
+[[d3security-connector-networking-configuration]]
+=== Connector networking configuration
+
+Use the <<action-settings, Action configuration settings>> to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.

docs/settings/alert-action-settings.asciidoc

@@ -138,7 +138,7 @@ WARNING: This feature is available in {kib} 7.17.4 and 8.3.0 onwards but is not
 A boolean value indicating that a footer with a relevant link should be added to emails sent as alerting actions. Default: true.
 
 `xpack.actions.enabledActionTypes` {ess-icon}::
-A list of action types that are enabled. It defaults to `[*]`, enabling all types. The names for built-in {kib} action types are prefixed with a `.` and include: `.email`, `.index`, `.jira`, `.opsgenie`, `.pagerduty`, `.resilient`, `.server-log`, `.servicenow`, .`servicenow-itom`, `.servicenow-sir`, `.slack`, `.swimlane`, `.teams`, `.tines`, `.torq`, `.xmatters`,  `.gen-ai`, and `.webhook`. An empty list `[]` will disable all action types.
+A list of action types that are enabled. It defaults to `[*]`, enabling all types. The names for built-in {kib} action types are prefixed with a `.` and include: `.email`, `.index`, `.jira`, `.opsgenie`, `.pagerduty`, `.resilient`, `.server-log`, `.servicenow`, .`servicenow-itom`, `.servicenow-sir`, `.slack`, `.swimlane`, `.teams`, `.tines`, `.torq`, `.xmatters`,  `.gen-ai`,  `.d3security`, and `.webhook`. An empty list `[]` will disable all action types.
 +
 Disabled action types will not appear as an option when creating new connectors, but existing connectors and actions of that type will remain in {kib} and will not function.
 

x-pack/plugins/stack_connectors/public/connector_types/d3security/d3security_connectors.tsx

@@ -18,7 +18,9 @@ const configFormSchema: ConfigFieldSchema[] = [
   { id: 'url', label: i18n.D3_URL_LABEL, isUrlField: true },
 ];
 
-const secretsFormSchema: SecretsFieldSchema[] = [{ id: 'token', label: i18n.D3_TOKEN_LABEL }];
+const secretsFormSchema: SecretsFieldSchema[] = [
+  { id: 'token', label: i18n.D3_TOKEN_LABEL, isPasswordField: true },
+];
 
 const D3SecurityConnectorFields: React.FC<ActionConnectorFieldsProps> = ({ readOnly, isEdit }) => {
   return (

x-pack/test/alerting_api_integration/common/config.ts

@@ -45,6 +45,7 @@ const enabledActionTypes = [
   '.jira',
   '.resilient',
   '.gen-ai',
+  '.d3security',
   '.slack',
   '.slack_api',
   '.tines',