openapi: 3.0.3 info: contact: name: Kibana Team description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects. The API calls are stateless. Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the request. API requests return JSON output, which is a format that is machine-readable and works well for automation. To interact with Kibana APIs, use the following operations: - GET: Fetches the information. - PATCH: Applies partial modifications to the existing information. - POST: Adds new information. - PUT: Updates the existing information. - DELETE: Removes the information. You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**. For example: ``` GET kbn:/api/data_views ``` For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console). NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs. ## Documentation source and versions This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository. It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/). This documentation contains work-in-progress information for future Elastic Stack releases. ' title: Kibana APIs Actions Security entity store API version: '' x-doc-license: name: Attribution-NonCommercial-NoDerivatives 4.0 International url: https://creativecommons.org/licenses/by-nc-nd/4.0/ x-feedbackLink: label: Feedback url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+ servers: - url: https://{kibana_url} variables: kibana_url: default: localhost:5601 security: - apiKeyAuth: [] - basicAuth: [] tags: - name: Security entity store paths: /api/security/entity_store: put: description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Update the Entity Store log extraction configuration.

[Required authorization] Route required privileges: securitySolution.' operationId: put-security-entity-store parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: updateLogExtractionExample: description: Update the log extraction configuration with a new lookback period and frequency. summary: Update log extraction settings value: logExtraction: fieldHistoryLength: 15 frequency: 10m lookbackPeriod: 6h schema: additionalProperties: false type: object properties: logExtraction: additionalProperties: false type: object properties: additionalIndexPatterns: items: type: string type: array delay: pattern: '[smdh]$' type: string docsLimit: maximum: 9007199254740991 minimum: 1 type: integer fieldHistoryLength: maximum: 9007199254740991 minimum: -9007199254740991 type: integer frequency: pattern: '[smdh]$' type: string lookbackPeriod: pattern: '[smdh]$' type: string maxLogsPerPage: maximum: 9007199254740991 minimum: 1 type: integer required: - logExtraction responses: '200': content: application/json: examples: updateSuccessExample: description: The Entity Store configuration was successfully updated. summary: Entity Store updated value: ok: true description: Indicates a successful response. '400': content: application/json: examples: invalidDurationExample: description: A log extraction parameter has an invalid duration format. summary: Invalid duration parameter value: error: Bad Request message: '[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)' statusCode: 400 description: Bad request. '404': content: application/json: examples: notFoundExample: description: The Entity Store has not been installed yet. summary: Entity Store not installed value: error: Not Found message: Entity store is not installed statusCode: 404 description: Entity Store not found. summary: Update the Entity Store tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"logExtraction\":{\"lookbackPeriod\":\"6h\",\"frequency\":\"10m\",\"fieldHistoryLength\":15}}' \\\n \"${KIBANA_URL}/api/security/entity_store\"\n" - lang: Console source: "PUT kbn://api/security/entity_store\n{\n \"logExtraction\": {\n \"lookbackPeriod\": \"6h\",\n \"frequency\": \"10m\",\n \"fieldHistoryLength\": 15\n }\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/entities: get: description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security/entity_store/entities
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.

[Required authorization] Route required privileges: securitySolution.' operationId: get-security-entity-store-entities parameters: - description: A Kibana Query Language (KQL) filter for the search-after mode. in: query name: filter required: false schema: type: string - description: Number of entities to return in search-after mode. in: query name: size required: false schema: maximum: 9007199254740991 minimum: 1 type: integer - description: JSON-encoded search_after value for cursor-based pagination. in: query name: searchAfter required: false schema: type: string - description: Fields to include in the response source. in: query name: source required: false schema: items: type: string type: array - description: Fields to include in the response. in: query name: fields required: false schema: items: type: string type: array - description: Field to sort results by in page mode. in: query name: sort_field required: false schema: type: string - description: Sort order in page mode. in: query name: sort_order required: false schema: enum: - asc - desc type: string - description: Page number to return (1-indexed) in page mode. in: query name: page required: false schema: maximum: 9007199254740991 minimum: 1 type: integer - description: Number of entities per page in page mode. in: query name: per_page required: false schema: maximum: 10000 minimum: 1 type: integer - description: An Elasticsearch query string to filter entities in page mode. in: query name: filterQuery required: false schema: type: string - description: Entity types to include in the results. in: query name: entity_types required: false schema: items: enum: - user - host - service - generic type: string type: array responses: '200': content: application/json: examples: emptyResultExample: description: No entities matched the query. summary: Empty result value: page: 1 per_page: 10 records: [] total: 0 pageModeExample: description: A paginated list of host entities sorted by timestamp in descending order, including query inspection data. summary: Page mode response with host entities value: inspect: dsl: - '{"index":["entities-latest-default"],"body":{"terms":{"entity.EngineMetadata.Type":["host"]}}}' response: - '{"took":1,"timed_out":false,"hits":{"total":{"value":1,"relation":"eq"}}}' page: 1 per_page: 10 records: - '@timestamp': '2026-04-10T08:30:00.000Z' asset: criticality: high_impact environment: production entity: attributes: asset: true managed: true id: host:web-server-prod-01 lifecycle: first_seen: '2026-01-15T10:00:00.000Z' last_activity: '2026-04-10T08:30:00.000Z' name: web-server-prod-01 risk: calculated_level: Moderate calculated_score: 47.5 calculated_score_norm: 47.5 source: - logs type: host host: hostname: - web-server-prod-01.example.com ip: - 10.0.1.42 name: web-server-prod-01 os: name: Ubuntu type: linux total: 1 searchAfterModeExample: description: A cursor-based response with entities and a search_after token for the next page. summary: Search-after mode response value: entities: - '@timestamp': '2026-04-10T08:30:00.000Z' entity: id: user:jane.doe@example.com name: jane.doe type: user user: email: - jane.doe@example.com name: jane.doe nextSearchAfter: - 1712736600000 - 1 description: Indicates a successful response. '400': content: application/json: examples: invalidFilterExample: description: The provided Kibana Query Language filter could not be parsed. summary: Invalid filter value: error: Bad Request message: 'Invalid filter: Expected "(", "{", value, whitespace but ":" found. invalid :: query ---------^' statusCode: 400 mixedModesExample: description: Cannot combine page-based pagination with cursor-based pagination in the same request. summary: Mixed pagination modes value: error: Bad Request message: '[request query]: Cannot combine page/per_page with searchAfter' statusCode: 400 description: Bad request. summary: List entities tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc\"\n" - lang: Console source: 'GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc ' x-metaTags: - content: Kibana name: product_name /api/security/entity_store/entities/: delete: description: '**Spaces method and path for this operation:**
delete /s/{space_id}/api/security/entity_store/entities/
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index.

[Required authorization] Route required privileges: securitySolution.' operationId: delete-security-entity-store-entities parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: deleteEntityExample: description: Delete a single entity from the Entity Store using its entity identifier. summary: Delete an entity by identifier value: entityId: host:web-server-prod-01 schema: additionalProperties: false type: object properties: entityId: description: The identifier of the entity to delete. type: string required: - entityId responses: '200': content: application/json: examples: deleteSuccessExample: description: The entity was found and successfully removed from the latest index. summary: Entity deleted value: deleted: true description: Indicates the entity was successfully deleted. '404': content: application/json: examples: notFoundExample: description: No entity with the specified identifier exists in the Entity Store. summary: Entity not found value: error: Not Found message: Entity ID 'host:web-server-prod-01' not found statusCode: 404 description: Entity not found. summary: Delete an entity tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X DELETE -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityId\":\"host:web-server-prod-01\"}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/\"\n" - lang: Console source: "DELETE kbn://api/security/entity_store/entities/\n{\n \"entityId\": \"host:web-server-prod-01\"\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/entities/{entityType}: post: description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/entities/{entityType}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Create a new entity record in the Entity Store for the specified entity type.

[Required authorization] Route required privileges: securitySolution.' operationId: post-security-entity-store-entities-entitytype parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string - description: The entity type to create. in: path name: entityType required: true schema: enum: - user - host - service - generic type: string requestBody: content: application/json: examples: createHostEntityExample: description: Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type. summary: Create a host entity value: asset: business_unit: Engineering criticality: high_impact environment: production entity: attributes: asset: true managed: true id: host:web-server-prod-01 name: web-server-prod-01 source: - manual type: host host: hostname: - web-server-prod-01.example.com ip: - 10.0.1.42 name: web-server-prod-01 schema: anyOf: - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} tags: items: type: string type: array user: additionalProperties: false type: object properties: domain: items: type: string type: array email: items: type: string type: array full_name: items: type: string type: array hash: items: type: string type: array id: items: type: string type: array name: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number roles: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string host: additionalProperties: false type: object properties: architecture: items: type: string type: array domain: items: type: string type: array hostname: items: type: string type: array id: items: type: string type: array ip: items: type: string type: array mac: items: type: string type: array name: type: string os: additionalProperties: false type: object properties: family: type: string full: type: string kernel: type: string name: anyOf: - type: string - items: type: string type: array platform: type: string type: anyOf: - type: string - items: type: string type: array version: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number type: items: type: string type: array labels: additionalProperties: {} type: object properties: {} tags: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} service: additionalProperties: false type: object properties: address: type: string environment: type: string ephemeral_id: type: string id: type: string name: type: string node: additionalProperties: false type: object properties: name: type: string role: type: string roles: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number state: type: string type: type: string version: type: string tags: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string cloud: additionalProperties: false type: object properties: account: additionalProperties: false type: object properties: id: type: string name: type: string availability_zone: type: string instance: additionalProperties: false type: object properties: id: type: string name: type: string machine: additionalProperties: false type: object properties: type: type: string project: additionalProperties: false type: object properties: id: type: string name: type: string provider: type: string region: type: string service: additionalProperties: false type: object properties: name: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} orchestrator: additionalProperties: false type: object properties: api_version: type: string cluster: additionalProperties: false type: object properties: id: type: string name: type: string url: type: string version: type: string namespace: type: string organization: type: string resource: additionalProperties: false type: object properties: annotation: type: string id: type: string ip: type: string label: type: string name: type: string parent: additionalProperties: false type: object properties: type: type: string type: type: string type: type: string tags: items: type: string type: array responses: '200': content: application/json: examples: createSuccessExample: description: The entity record was successfully created in the Entity Store. summary: Entity created value: ok: true description: Indicates the entity was successfully created. '400': content: application/json: examples: euidMismatchExample: description: The supplied entity identifier does not match the auto-generated identifier derived from the entity fields. summary: Entity identifier mismatch value: error: Bad Request message: 'Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01' statusCode: 400 description: Bad request. '409': content: application/json: examples: conflictExample: description: An entity with the specified identifier already exists. summary: Entity already exists value: error: Conflict message: Entity ID 'host:web-server-prod-01' already exists statusCode: 409 description: Conflict. summary: Create an entity tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"source\":[\"manual\"],\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\",\"ip\":[\"10.0.1.42\"]}}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/host\"\n" - lang: Console source: "POST kbn://api/security/entity_store/entities/host\n{\n \"entity\": {\n \"id\": \"host:web-server-prod-01\",\n \"name\": \"web-server-prod-01\",\n \"type\": \"host\",\n \"source\": [\"manual\"],\n \"attributes\": { \"asset\": true }\n },\n \"host\": {\n \"name\": \"web-server-prod-01\",\n \"ip\": [\"10.0.1.42\"]\n }\n}\n" x-metaTags: - content: Kibana name: product_name put: description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/entities/{entityType}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.

[Required authorization] Route required privileges: securitySolution.' operationId: put-security-entity-store-entities-entitytype parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string - description: The entity type to update. in: path name: entityType required: true schema: enum: - user - host - service - generic type: string - description: When true, allows updating protected fields. in: query name: force required: false schema: anyOf: - enum: - 'true' - 'false' type: string - type: boolean default: false requestBody: content: application/json: examples: updateEntityAttributesExample: description: Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter. summary: Update entity attributes value: entity: attributes: managed: true mfa_enabled: true id: user:jane.doe@example.com lifecycle: last_activity: '2026-04-10T14:30:00.000Z' name: jane.doe type: user user: email: - jane.doe@example.com name: jane.doe roles: - admin - analyst schema: anyOf: - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} tags: items: type: string type: array user: additionalProperties: false type: object properties: domain: items: type: string type: array email: items: type: string type: array full_name: items: type: string type: array hash: items: type: string type: array id: items: type: string type: array name: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number roles: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string host: additionalProperties: false type: object properties: architecture: items: type: string type: array domain: items: type: string type: array hostname: items: type: string type: array id: items: type: string type: array ip: items: type: string type: array mac: items: type: string type: array name: type: string os: additionalProperties: false type: object properties: family: type: string full: type: string kernel: type: string name: anyOf: - type: string - items: type: string type: array platform: type: string type: anyOf: - type: string - items: type: string type: array version: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number type: items: type: string type: array labels: additionalProperties: {} type: object properties: {} tags: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} service: additionalProperties: false type: object properties: address: type: string environment: type: string ephemeral_id: type: string id: type: string name: type: string node: additionalProperties: false type: object properties: name: type: string role: type: string roles: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number state: type: string type: type: string version: type: string tags: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string cloud: additionalProperties: false type: object properties: account: additionalProperties: false type: object properties: id: type: string name: type: string availability_zone: type: string instance: additionalProperties: false type: object properties: id: type: string name: type: string machine: additionalProperties: false type: object properties: type: type: string project: additionalProperties: false type: object properties: id: type: string name: type: string provider: type: string region: type: string service: additionalProperties: false type: object properties: name: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} orchestrator: additionalProperties: false type: object properties: api_version: type: string cluster: additionalProperties: false type: object properties: id: type: string name: type: string url: type: string version: type: string namespace: type: string organization: type: string resource: additionalProperties: false type: object properties: annotation: type: string id: type: string ip: type: string label: type: string name: type: string parent: additionalProperties: false type: object properties: type: type: string type: type: string type: type: string tags: items: type: string type: array responses: '200': content: application/json: examples: updateSuccessExample: description: The entity record was successfully updated. summary: Entity updated value: ok: true description: Indicates the entity was successfully updated. '400': content: application/json: examples: protectedFieldsExample: description: The request attempts to update protected fields without the force query parameter. summary: Protected fields without force value: error: Bad Request message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type' statusCode: 400 description: Bad request. '404': content: application/json: examples: notFoundExample: description: No entity with the specified identifier exists. summary: Entity not found value: error: Not Found message: Entity ID 'user:jane.doe@example.com' not found statusCode: 404 description: Entity not found. summary: Update an entity tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity\":{\"id\":\"user:jane.doe@example.com\",\"name\":\"jane.doe\",\"type\":\"user\",\"attributes\":{\"managed\":true,\"mfa_enabled\":true}},\"user\":{\"name\":\"jane.doe\"}}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/user?force=true\"\n" - lang: Console source: "PUT kbn://api/security/entity_store/entities/user?force=true\n{\n \"entity\": {\n \"id\": \"user:jane.doe@example.com\",\n \"name\": \"jane.doe\",\n \"type\": \"user\",\n \"attributes\": { \"managed\": true, \"mfa_enabled\": true }\n },\n \"user\": { \"name\": \"jane.doe\" }\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/entities/bulk: put: description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/entities/bulk
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Update multiple entity records in the Entity Store in a single request.

[Required authorization] Route required privileges: securitySolution.' operationId: put-security-entity-store-entities-bulk parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string - description: When true, allows updating protected fields. in: query name: force required: false schema: anyOf: - enum: - 'true' - 'false' type: string - type: boolean default: false requestBody: content: application/json: examples: bulkUpdateExample: description: Update a host entity and a user entity in a single request. summary: Bulk update multiple entities value: entities: - doc: entity: attributes: asset: true id: host:web-server-prod-01 name: web-server-prod-01 type: host host: name: web-server-prod-01 type: host - doc: entity: attributes: managed: true id: user:jane.doe@example.com name: jane.doe type: user user: name: jane.doe type: user schema: additionalProperties: false type: object properties: entities: description: The entities to update. items: type: object properties: doc: anyOf: - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} tags: items: type: string type: array user: additionalProperties: false type: object properties: domain: items: type: string type: array email: items: type: string type: array full_name: items: type: string type: array hash: items: type: string type: array id: items: type: string type: array name: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number roles: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string host: additionalProperties: false type: object properties: architecture: items: type: string type: array domain: items: type: string type: array hostname: items: type: string type: array id: items: type: string type: array ip: items: type: string type: array mac: items: type: string type: array name: type: string os: additionalProperties: false type: object properties: family: type: string full: type: string kernel: type: string name: anyOf: - type: string - items: type: string type: array platform: type: string type: anyOf: - type: string - items: type: string type: array version: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number type: items: type: string type: array labels: additionalProperties: {} type: object properties: {} tags: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} service: additionalProperties: false type: object properties: address: type: string environment: type: string ephemeral_id: type: string id: type: string name: type: string node: additionalProperties: false type: object properties: name: type: string role: type: string roles: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number state: type: string type: type: string version: type: string tags: items: type: string type: array - additionalProperties: false type: object properties: '@timestamp': format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string asset: additionalProperties: false type: object properties: business_unit: type: string criticality: anyOf: - enum: - low_impact - medium_impact - high_impact - extreme_impact type: string - nullable: true environment: type: string id: type: string model: type: string name: type: string owner: type: string serial_number: type: string vendor: type: string cloud: additionalProperties: false type: object properties: account: additionalProperties: false type: object properties: id: type: string name: type: string availability_zone: type: string instance: additionalProperties: false type: object properties: id: type: string name: type: string machine: additionalProperties: false type: object properties: type: type: string project: additionalProperties: false type: object properties: id: type: string name: type: string provider: type: string region: type: string service: additionalProperties: false type: object properties: name: type: string entity: additionalProperties: false type: object properties: attributes: additionalProperties: false type: object properties: asset: type: boolean known_redirects: items: type: string type: array managed: type: boolean mfa_enabled: type: boolean oauth_consent_restriction: type: string permissions: items: type: string type: array storage_class: type: string watchlists: items: type: string type: array behaviors: additionalProperties: false type: object properties: anomaly_job_ids: items: type: string type: array rule_names: items: type: string type: array EngineMetadata: additionalProperties: false type: object properties: Type: type: string id: type: string lifecycle: additionalProperties: false type: object properties: first_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_activity: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string last_seen: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string name: type: string relationships: additionalProperties: false type: object properties: accesses_frequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array accesses_infrequently: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array administers: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array communicates_with: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array depends_on: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array owns_inferred: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array resolution: additionalProperties: false type: object properties: resolved_to: type: string risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number supervises: additionalProperties: false type: object properties: ids: items: type: string type: array raw_identifiers: additionalProperties: false type: object properties: entity.id: items: type: string type: array host.id: items: type: string type: array host.name: items: type: string type: array service.name: items: type: string type: array user.email: items: type: string type: array user.id: items: type: string type: array user.name: items: type: string type: array risk: additionalProperties: false type: object properties: calculated_level: enum: - Unknown - Low - Moderate - High - Critical type: string calculated_score: type: number calculated_score_norm: maximum: 100 minimum: 0 type: number schema_version: type: string source: items: type: string type: array sub_type: type: string type: type: string url: type: string event: additionalProperties: false type: object properties: ingested: format: date-time pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string labels: additionalProperties: {} type: object properties: {} orchestrator: additionalProperties: false type: object properties: api_version: type: string cluster: additionalProperties: false type: object properties: id: type: string name: type: string url: type: string version: type: string namespace: type: string organization: type: string resource: additionalProperties: false type: object properties: annotation: type: string id: type: string ip: type: string label: type: string name: type: string parent: additionalProperties: false type: object properties: type: type: string type: type: string type: type: string tags: items: type: string type: array type: description: The entity type of this record. enum: - user - host - service - generic type: string required: - type - doc type: array required: - entities responses: '200': content: application/json: examples: bulkUpdatePartialExample: description: Some entities were updated but others encountered Elasticsearch-level errors. summary: Partial success with errors value: errors: - _id: 5de9f93a68a72532e736bf5a6184b06300b9cabf reason: '[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing' status: 404 type: document_missing_exception ok: true bulkUpdateSuccessExample: description: All entities were successfully updated with no errors. summary: All entities updated value: errors: [] ok: true description: Indicates a successful response. '400': content: application/json: examples: protectedFieldsExample: description: The request attempts to update protected fields without the force query parameter. summary: Protected fields without force value: error: Bad Request message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type' statusCode: 400 description: Bad request. summary: Bulk update entities tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entities\":[{\"type\":\"host\",\"doc\":{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\"}}}]}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true\"\n" - lang: Console source: "PUT kbn://api/security/entity_store/entities/bulk?force=true\n{\n \"entities\": [\n {\n \"type\": \"host\",\n \"doc\": {\n \"entity\": {\n \"id\": \"host:web-server-prod-01\",\n \"name\": \"web-server-prod-01\",\n \"type\": \"host\",\n \"attributes\": { \"asset\": true }\n },\n \"host\": { \"name\": \"web-server-prod-01\" }\n }\n }\n ]\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/install: post: description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/install
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Install the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. To change settings after install, use the update endpoint.

[Required authorization] Route required privileges: securitySolution.' operationId: post-security-entity-store-install parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: installDefaultExample: description: Install the Entity Store for all entity types with default log extraction settings. summary: Install with default entity types value: entityTypes: - user - host - service - generic logExtraction: {} installWithCustomSettingsExample: description: Install the Entity Store for host entities only with a custom lookback period and field history length. summary: Install with custom log extraction value: entityTypes: - host logExtraction: delay: 2m fieldHistoryLength: 20 frequency: 5m lookbackPeriod: 12h schema: additionalProperties: false type: object properties: entityTypes: default: - user - host - service - generic items: enum: - user - host - service - generic type: string type: array historySnapshot: additionalProperties: false type: object properties: frequency: default: 24h pattern: '[smdh]$' type: string logExtraction: additionalProperties: false type: object properties: additionalIndexPatterns: default: [] items: type: string type: array delay: default: 1m pattern: '[smdh]$' type: string docsLimit: default: 10000 maximum: 9007199254740991 minimum: 1 type: integer fieldHistoryLength: default: 10 maximum: 9007199254740991 minimum: -9007199254740991 type: integer frequency: default: 1m pattern: '[smdh]$' type: string lookbackPeriod: default: 3h pattern: '[smdh]$' type: string maxLogsPerPage: default: 40000 maximum: 9007199254740991 minimum: 1 type: integer responses: '200': content: application/json: examples: alreadyInstalledExample: description: All requested entity types were already installed. summary: Already installed value: ok: true description: Indicates all requested entity types are already installed. '201': content: application/json: examples: installSuccessExample: description: The Entity Store was installed and engines are being created. summary: Entity Store installed value: ok: true description: Indicates the Entity Store was successfully installed. '403': content: application/json: examples: forbiddenExample: description: The user does not have the required Elasticsearch privileges. summary: Insufficient privileges value: error: Forbidden message: User 'analyst' has insufficient privileges statusCode: 403 description: Insufficient privileges. summary: Install the Entity Store tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"],\"logExtraction\":{}}' \\\n \"${KIBANA_URL}/api/security/entity_store/install\"\n" - lang: Console source: "POST kbn://api/security/entity_store/install\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"],\n \"logExtraction\": {}\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/resolution/group: get: description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security/entity_store/resolution/group
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Get the resolution group for a given entity, returning all linked entities. Requires an enterprise license.

[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.' operationId: get-security-entity-store-resolution-group parameters: - description: The entity identifier to look up the resolution group for. in: query name: entity_id required: true schema: type: string responses: '200': content: application/json: examples: resolutionGroupExample: description: Returns the resolution group for an entity, including the target entity, all aliases, and the group size. summary: Resolution group with linked entities value: aliases: - '@timestamp': '2026-04-10T08:25:00.000Z' entity: id: user:jdoe@example.com name: jdoe relationships: resolution: resolved_to: user:jane.doe@example.com type: user user: name: jdoe group_size: 2 target: '@timestamp': '2026-04-10T08:30:00.000Z' entity: id: user:jane.doe@example.com name: jane.doe type: user user: email: - jane.doe@example.com name: jane.doe description: Indicates a successful response. '400': content: application/json: examples: truncatedSearchExample: description: The resolution search returned too many results and was truncated. summary: Search results truncated value: error: Bad Request message: Resolution search truncated statusCode: 400 description: Bad request. '404': content: application/json: examples: notFoundExample: description: The specified entity does not exist or has no resolution group. summary: Entity not found value: error: Not Found message: 'Entities not found: [user:nonexistent@example.com]' statusCode: 404 description: Entity not found. summary: Get resolution group tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/group?entity_id=user%3Ajane.doe%40example.com\"\n" - lang: Console source: 'GET kbn://api/security/entity_store/resolution/group?entity_id=user:jane.doe@example.com ' x-metaTags: - content: Kibana name: product_name /api/security/entity_store/resolution/link: post: description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/resolution/link
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Link one or more entities to a target entity, creating a resolution group. Requires an enterprise license.

[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.' operationId: post-security-entity-store-resolution-link parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: linkEntitiesExample: description: Link two user entities to a target entity, creating a resolution group. summary: Link entities to a target value: entity_ids: - user:jdoe@example.com - user:j.doe@example.com target_id: user:jane.doe@example.com schema: additionalProperties: false type: object properties: entity_ids: description: Entity identifiers to link to the target entity. Minimum 1, maximum 1000. items: type: string maxItems: 1000 minItems: 1 type: array target_id: description: The entity identifier to resolve the linked entities to. type: string required: - target_id - entity_ids responses: '200': content: application/json: examples: linkSuccessExample: description: The entities were successfully linked to the target entity. summary: Entities linked value: linked: - user:jdoe@example.com - user:j.doe@example.com skipped: [] target_id: user:jane.doe@example.com description: Indicates a successful response. '400': content: application/json: examples: mixedTypesExample: description: All entities in a resolution group must be of the same type. summary: Mixed entity types value: error: Bad Request message: Cannot link entities of different types statusCode: 400 selfLinkExample: description: Cannot link an entity to itself. summary: Self-link error value: error: Bad Request message: Cannot link entity 'user:jane.doe@example.com' to itself. statusCode: 400 description: Bad request. '404': content: application/json: examples: notFoundExample: description: One or more of the specified entity identifiers were not found. summary: Entities not found value: error: Not Found message: 'Entities not found: [user:nonexistent@example.com, user:also-nonexistent@example.com]' statusCode: 404 description: Entities not found. summary: Link entities tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"target_id\":\"user:jane.doe@example.com\",\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/link\"\n" - lang: Console source: "POST kbn://api/security/entity_store/resolution/link\n{\n \"target_id\": \"user:jane.doe@example.com\",\n \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/resolution/unlink: post: description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/resolution/unlink
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Remove one or more entities from their resolution group. Requires an enterprise license.

[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.' operationId: post-security-entity-store-resolution-unlink parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: unlinkEntitiesExample: description: Remove entities from their resolution group, restoring them as standalone entities. summary: Unlink entities from their resolution group value: entity_ids: - user:jdoe@example.com - user:j.doe@example.com schema: additionalProperties: false type: object properties: entity_ids: description: Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000. items: type: string maxItems: 1000 minItems: 1 type: array required: - entity_ids responses: '200': content: application/json: examples: unlinkSuccessExample: description: The entities were successfully removed from their resolution group. summary: Entities unlinked value: skipped: [] unlinked: - user:jdoe@example.com - user:j.doe@example.com description: Indicates a successful response. '404': content: application/json: examples: notFoundExample: description: One or more of the specified entity identifiers were not found. summary: Entities not found value: error: Not Found message: 'Entities not found: [user:nonexistent@example.com]' statusCode: 404 description: Entities not found. summary: Unlink entities tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/unlink\"\n" - lang: Console source: "POST kbn://api/security/entity_store/resolution/unlink\n{\n \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/start: put: description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/start
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Start previously stopped entity engines, resuming data processing for the specified entity types.

[Required authorization] Route required privileges: securitySolution.' operationId: put-security-entity-store-start parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: startAllExample: description: Start all stopped entity engines. summary: Start all entity engines value: entityTypes: - user - host - service - generic startSingleExample: description: Start only the host entity engine. summary: Start a single entity engine value: entityTypes: - host schema: additionalProperties: false type: object properties: entityTypes: default: - user - host - service - generic description: Entity types to start. Defaults to all installed types. items: enum: - user - host - service - generic type: string type: array responses: '200': content: application/json: examples: startSuccessExample: description: The specified entity engines were successfully started. summary: Engines started value: ok: true description: Indicates a successful response. summary: Start Entity Store engines tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/start\"\n" - lang: Console source: "PUT kbn://api/security/entity_store/start\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/status: get: description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security/entity_store/status
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Get the overall Entity Store status and per-engine statuses, optionally including component-level health details.

[Required authorization] Route required privileges: securitySolution.' operationId: get-security-entity-store-status parameters: - description: If true, returns a detailed status of each engine including all its components. in: query name: include_components required: false schema: anyOf: - enum: - 'true' - 'false' type: string - type: boolean default: false responses: '200': content: application/json: examples: notInstalledExample: description: The Entity Store has not been installed. summary: Entity Store not installed value: engines: [] status: not_installed runningStatusExample: description: The Entity Store is running with two started engines using default settings. summary: Entity Store running value: engines: - delay: 1m docsPerSecond: -1 enrichPolicyExecutionInterval: null fieldHistoryLength: 10 filter: '' frequency: 30s indexPattern: '' lastExecutionTimestamp: '2026-04-10T08:30:00.000Z' lookbackPeriod: 3h maxPageSearchSize: 10000 status: started timeout: 25s timestampField: '@timestamp' type: host - delay: 1m docsPerSecond: -1 enrichPolicyExecutionInterval: null fieldHistoryLength: 10 filter: '' frequency: 30s indexPattern: '' lastExecutionTimestamp: '2026-04-10T08:30:00.000Z' lookbackPeriod: 3h maxPageSearchSize: 10000 status: started timeout: 25s timestampField: '@timestamp' type: user status: running description: Indicates a successful response. summary: Get Entity Store status tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/status?include_components=false\"\n" - lang: Console source: 'GET kbn://api/security/entity_store/status?include_components=false ' x-metaTags: - content: Kibana name: product_name /api/security/entity_store/stop: put: description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/stop
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Stop running entity engines, pausing data processing for the specified entity types.

[Required authorization] Route required privileges: securitySolution.' operationId: put-security-entity-store-stop parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: stopAllExample: description: Stop all running entity engines. summary: Stop all entity engines value: entityTypes: - user - host - service - generic schema: additionalProperties: false type: object properties: entityTypes: default: - user - host - service - generic description: Entity types to stop. Defaults to all running types. items: enum: - user - host - service - generic type: string type: array responses: '200': content: application/json: examples: stopSuccessExample: description: The specified entity engines were successfully stopped. summary: Engines stopped value: ok: true description: Indicates a successful response. summary: Stop Entity Store engines tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/stop\"\n" - lang: Console source: "PUT kbn://api/security/entity_store/stop\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n" x-metaTags: - content: Kibana name: product_name /api/security/entity_store/uninstall: post: description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/uninstall
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Uninstall the Entity Store, removing engines and associated resources for the specified entity types.

[Required authorization] Route required privileges: securitySolution.' operationId: post-security-entity-store-uninstall parameters: - description: A required header to protect against CSRF attacks in: header name: kbn-xsrf required: true schema: example: 'true' type: string requestBody: content: application/json: examples: uninstallAllExample: description: Uninstall all entity engines from the Entity Store. summary: Uninstall all entity types value: entityTypes: - user - host - service - generic uninstallSingleExample: description: Uninstall only the host engine from the Entity Store. summary: Uninstall a single entity type value: entityTypes: - host schema: additionalProperties: false type: object properties: entityTypes: default: - user - host - service - generic description: Entity types to uninstall. Defaults to all installed types. items: enum: - user - host - service - generic type: string type: array responses: '200': content: application/json: examples: uninstallSuccessExample: description: The specified entity engines were successfully uninstalled. summary: Entity Store uninstalled value: ok: true description: Indicates a successful response. summary: Uninstall the Entity Store tags: - Security entity store x-codeSamples: - lang: curl source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/uninstall\"\n" - lang: Console source: "POST kbn://api/security/entity_store/uninstall\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n" x-metaTags: - content: Kibana name: product_name components: securitySchemes: apiKeyAuth: description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey` ' in: header name: Authorization type: apiKey basicAuth: scheme: basic type: http x-topics: - title: Kibana spaces content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"