openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Security entity store API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Security entity store
paths:
/api/security/entity_store:
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update the Entity Store log extraction configuration.
[Required authorization] Route required privileges: securitySolution.'
operationId: put-security-entity-store
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
updateLogExtractionExample:
description: Update the log extraction configuration with a new lookback period and frequency.
summary: Update log extraction settings
value:
logExtraction:
fieldHistoryLength: 15
frequency: 10m
lookbackPeriod: 6h
schema:
additionalProperties: false
type: object
properties:
logExtraction:
additionalProperties: false
type: object
properties:
additionalIndexPatterns:
items:
type: string
type: array
delay:
pattern: '[smdh]$'
type: string
docsLimit:
maximum: 9007199254740991
minimum: 1
type: integer
fieldHistoryLength:
maximum: 9007199254740991
minimum: -9007199254740991
type: integer
frequency:
pattern: '[smdh]$'
type: string
lookbackPeriod:
pattern: '[smdh]$'
type: string
maxLogsPerPage:
maximum: 9007199254740991
minimum: 1
type: integer
required:
- logExtraction
responses:
'200':
content:
application/json:
examples:
updateSuccessExample:
description: The Entity Store configuration was successfully updated.
summary: Entity Store updated
value:
ok: true
description: Indicates a successful response.
'400':
content:
application/json:
examples:
invalidDurationExample:
description: A log extraction parameter has an invalid duration format.
summary: Invalid duration parameter
value:
error: Bad Request
message: '[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)'
statusCode: 400
description: Bad request.
'404':
content:
application/json:
examples:
notFoundExample:
description: The Entity Store has not been installed yet.
summary: Entity Store not installed
value:
error: Not Found
message: Entity store is not installed
statusCode: 404
description: Entity Store not found.
summary: Update the Entity Store
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"logExtraction\":{\"lookbackPeriod\":\"6h\",\"frequency\":\"10m\",\"fieldHistoryLength\":15}}' \\\n \"${KIBANA_URL}/api/security/entity_store\"\n"
- lang: Console
source: "PUT kbn://api/security/entity_store\n{\n \"logExtraction\": {\n \"lookbackPeriod\": \"6h\",\n \"frequency\": \"10m\",\n \"fieldHistoryLength\": 15\n }\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security/entity_store/entities
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.
[Required authorization] Route required privileges: securitySolution.'
operationId: get-security-entity-store-entities
parameters:
- description: A Kibana Query Language (KQL) filter for the search-after mode.
in: query
name: filter
required: false
schema:
type: string
- description: Number of entities to return in search-after mode.
in: query
name: size
required: false
schema:
maximum: 9007199254740991
minimum: 1
type: integer
- description: JSON-encoded search_after value for cursor-based pagination.
in: query
name: searchAfter
required: false
schema:
type: string
- description: Fields to include in the response source.
in: query
name: source
required: false
schema:
items:
type: string
type: array
- description: Fields to include in the response.
in: query
name: fields
required: false
schema:
items:
type: string
type: array
- description: Field to sort results by in page mode.
in: query
name: sort_field
required: false
schema:
type: string
- description: Sort order in page mode.
in: query
name: sort_order
required: false
schema:
enum:
- asc
- desc
type: string
- description: Page number to return (1-indexed) in page mode.
in: query
name: page
required: false
schema:
maximum: 9007199254740991
minimum: 1
type: integer
- description: Number of entities per page in page mode.
in: query
name: per_page
required: false
schema:
maximum: 10000
minimum: 1
type: integer
- description: An Elasticsearch query string to filter entities in page mode.
in: query
name: filterQuery
required: false
schema:
type: string
- description: Entity types to include in the results.
in: query
name: entity_types
required: false
schema:
items:
enum:
- user
- host
- service
- generic
type: string
type: array
responses:
'200':
content:
application/json:
examples:
emptyResultExample:
description: No entities matched the query.
summary: Empty result
value:
page: 1
per_page: 10
records: []
total: 0
pageModeExample:
description: A paginated list of host entities sorted by timestamp in descending order, including query inspection data.
summary: Page mode response with host entities
value:
inspect:
dsl:
- '{"index":["entities-latest-default"],"body":{"terms":{"entity.EngineMetadata.Type":["host"]}}}'
response:
- '{"took":1,"timed_out":false,"hits":{"total":{"value":1,"relation":"eq"}}}'
page: 1
per_page: 10
records:
- '@timestamp': '2026-04-10T08:30:00.000Z'
asset:
criticality: high_impact
environment: production
entity:
attributes:
asset: true
managed: true
id: host:web-server-prod-01
lifecycle:
first_seen: '2026-01-15T10:00:00.000Z'
last_activity: '2026-04-10T08:30:00.000Z'
name: web-server-prod-01
risk:
calculated_level: Moderate
calculated_score: 47.5
calculated_score_norm: 47.5
source:
- logs
type: host
host:
hostname:
- web-server-prod-01.example.com
ip:
- 10.0.1.42
name: web-server-prod-01
os:
name: Ubuntu
type: linux
total: 1
searchAfterModeExample:
description: A cursor-based response with entities and a search_after token for the next page.
summary: Search-after mode response
value:
entities:
- '@timestamp': '2026-04-10T08:30:00.000Z'
entity:
id: user:jane.doe@example.com
name: jane.doe
type: user
user:
email:
- jane.doe@example.com
name: jane.doe
nextSearchAfter:
- 1712736600000
- 1
description: Indicates a successful response.
'400':
content:
application/json:
examples:
invalidFilterExample:
description: The provided Kibana Query Language filter could not be parsed.
summary: Invalid filter
value:
error: Bad Request
message: 'Invalid filter: Expected "(", "{", value, whitespace but ":" found.
invalid :: query
---------^'
statusCode: 400
mixedModesExample:
description: Cannot combine page-based pagination with cursor-based pagination in the same request.
summary: Mixed pagination modes
value:
error: Bad Request
message: '[request query]: Cannot combine page/per_page with searchAfter'
statusCode: 400
description: Bad request.
summary: List entities
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc\"\n"
- lang: Console
source: 'GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc
'
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities/:
delete:
description: '**Spaces method and path for this operation:**
delete /s/{space_id}/api/security/entity_store/entities/
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index.
[Required authorization] Route required privileges: securitySolution.'
operationId: delete-security-entity-store-entities
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
deleteEntityExample:
description: Delete a single entity from the Entity Store using its entity identifier.
summary: Delete an entity by identifier
value:
entityId: host:web-server-prod-01
schema:
additionalProperties: false
type: object
properties:
entityId:
description: The identifier of the entity to delete.
type: string
required:
- entityId
responses:
'200':
content:
application/json:
examples:
deleteSuccessExample:
description: The entity was found and successfully removed from the latest index.
summary: Entity deleted
value:
deleted: true
description: Indicates the entity was successfully deleted.
'404':
content:
application/json:
examples:
notFoundExample:
description: No entity with the specified identifier exists in the Entity Store.
summary: Entity not found
value:
error: Not Found
message: Entity ID 'host:web-server-prod-01' not found
statusCode: 404
description: Entity not found.
summary: Delete an entity
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X DELETE -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityId\":\"host:web-server-prod-01\"}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/\"\n"
- lang: Console
source: "DELETE kbn://api/security/entity_store/entities/\n{\n \"entityId\": \"host:web-server-prod-01\"\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities/{entityType}:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/entities/{entityType}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new entity record in the Entity Store for the specified entity type.
[Required authorization] Route required privileges: securitySolution.'
operationId: post-security-entity-store-entities-entitytype
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: The entity type to create.
in: path
name: entityType
required: true
schema:
enum:
- user
- host
- service
- generic
type: string
requestBody:
content:
application/json:
examples:
createHostEntityExample:
description: Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type.
summary: Create a host entity
value:
asset:
business_unit: Engineering
criticality: high_impact
environment: production
entity:
attributes:
asset: true
managed: true
id: host:web-server-prod-01
name: web-server-prod-01
source:
- manual
type: host
host:
hostname:
- web-server-prod-01.example.com
ip:
- 10.0.1.42
name: web-server-prod-01
schema:
anyOf:
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
tags:
items:
type: string
type: array
user:
additionalProperties: false
type: object
properties:
domain:
items:
type: string
type: array
email:
items:
type: string
type: array
full_name:
items:
type: string
type: array
hash:
items:
type: string
type: array
id:
items:
type: string
type: array
name:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
roles:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
host:
additionalProperties: false
type: object
properties:
architecture:
items:
type: string
type: array
domain:
items:
type: string
type: array
hostname:
items:
type: string
type: array
id:
items:
type: string
type: array
ip:
items:
type: string
type: array
mac:
items:
type: string
type: array
name:
type: string
os:
additionalProperties: false
type: object
properties:
family:
type: string
full:
type: string
kernel:
type: string
name:
anyOf:
- type: string
- items:
type: string
type: array
platform:
type: string
type:
anyOf:
- type: string
- items:
type: string
type: array
version:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
type:
items:
type: string
type: array
labels:
additionalProperties: {}
type: object
properties: {}
tags:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
service:
additionalProperties: false
type: object
properties:
address:
type: string
environment:
type: string
ephemeral_id:
type: string
id:
type: string
name:
type: string
node:
additionalProperties: false
type: object
properties:
name:
type: string
role:
type: string
roles:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
state:
type: string
type:
type: string
version:
type: string
tags:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
cloud:
additionalProperties: false
type: object
properties:
account:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
availability_zone:
type: string
instance:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
machine:
additionalProperties: false
type: object
properties:
type:
type: string
project:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
provider:
type: string
region:
type: string
service:
additionalProperties: false
type: object
properties:
name:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
orchestrator:
additionalProperties: false
type: object
properties:
api_version:
type: string
cluster:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
url:
type: string
version:
type: string
namespace:
type: string
organization:
type: string
resource:
additionalProperties: false
type: object
properties:
annotation:
type: string
id:
type: string
ip:
type: string
label:
type: string
name:
type: string
parent:
additionalProperties: false
type: object
properties:
type:
type: string
type:
type: string
type:
type: string
tags:
items:
type: string
type: array
responses:
'200':
content:
application/json:
examples:
createSuccessExample:
description: The entity record was successfully created in the Entity Store.
summary: Entity created
value:
ok: true
description: Indicates the entity was successfully created.
'400':
content:
application/json:
examples:
euidMismatchExample:
description: The supplied entity identifier does not match the auto-generated identifier derived from the entity fields.
summary: Entity identifier mismatch
value:
error: Bad Request
message: 'Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01'
statusCode: 400
description: Bad request.
'409':
content:
application/json:
examples:
conflictExample:
description: An entity with the specified identifier already exists.
summary: Entity already exists
value:
error: Conflict
message: Entity ID 'host:web-server-prod-01' already exists
statusCode: 409
description: Conflict.
summary: Create an entity
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"source\":[\"manual\"],\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\",\"ip\":[\"10.0.1.42\"]}}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/host\"\n"
- lang: Console
source: "POST kbn://api/security/entity_store/entities/host\n{\n \"entity\": {\n \"id\": \"host:web-server-prod-01\",\n \"name\": \"web-server-prod-01\",\n \"type\": \"host\",\n \"source\": [\"manual\"],\n \"attributes\": { \"asset\": true }\n },\n \"host\": {\n \"name\": \"web-server-prod-01\",\n \"ip\": [\"10.0.1.42\"]\n }\n}\n"
x-metaTags:
- content: Kibana
name: product_name
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/entities/{entityType}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.
[Required authorization] Route required privileges: securitySolution.'
operationId: put-security-entity-store-entities-entitytype
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: The entity type to update.
in: path
name: entityType
required: true
schema:
enum:
- user
- host
- service
- generic
type: string
- description: When true, allows updating protected fields.
in: query
name: force
required: false
schema:
anyOf:
- enum:
- 'true'
- 'false'
type: string
- type: boolean
default: false
requestBody:
content:
application/json:
examples:
updateEntityAttributesExample:
description: Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter.
summary: Update entity attributes
value:
entity:
attributes:
managed: true
mfa_enabled: true
id: user:jane.doe@example.com
lifecycle:
last_activity: '2026-04-10T14:30:00.000Z'
name: jane.doe
type: user
user:
email:
- jane.doe@example.com
name: jane.doe
roles:
- admin
- analyst
schema:
anyOf:
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
tags:
items:
type: string
type: array
user:
additionalProperties: false
type: object
properties:
domain:
items:
type: string
type: array
email:
items:
type: string
type: array
full_name:
items:
type: string
type: array
hash:
items:
type: string
type: array
id:
items:
type: string
type: array
name:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
roles:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
host:
additionalProperties: false
type: object
properties:
architecture:
items:
type: string
type: array
domain:
items:
type: string
type: array
hostname:
items:
type: string
type: array
id:
items:
type: string
type: array
ip:
items:
type: string
type: array
mac:
items:
type: string
type: array
name:
type: string
os:
additionalProperties: false
type: object
properties:
family:
type: string
full:
type: string
kernel:
type: string
name:
anyOf:
- type: string
- items:
type: string
type: array
platform:
type: string
type:
anyOf:
- type: string
- items:
type: string
type: array
version:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
type:
items:
type: string
type: array
labels:
additionalProperties: {}
type: object
properties: {}
tags:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
service:
additionalProperties: false
type: object
properties:
address:
type: string
environment:
type: string
ephemeral_id:
type: string
id:
type: string
name:
type: string
node:
additionalProperties: false
type: object
properties:
name:
type: string
role:
type: string
roles:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
state:
type: string
type:
type: string
version:
type: string
tags:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
cloud:
additionalProperties: false
type: object
properties:
account:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
availability_zone:
type: string
instance:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
machine:
additionalProperties: false
type: object
properties:
type:
type: string
project:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
provider:
type: string
region:
type: string
service:
additionalProperties: false
type: object
properties:
name:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
orchestrator:
additionalProperties: false
type: object
properties:
api_version:
type: string
cluster:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
url:
type: string
version:
type: string
namespace:
type: string
organization:
type: string
resource:
additionalProperties: false
type: object
properties:
annotation:
type: string
id:
type: string
ip:
type: string
label:
type: string
name:
type: string
parent:
additionalProperties: false
type: object
properties:
type:
type: string
type:
type: string
type:
type: string
tags:
items:
type: string
type: array
responses:
'200':
content:
application/json:
examples:
updateSuccessExample:
description: The entity record was successfully updated.
summary: Entity updated
value:
ok: true
description: Indicates the entity was successfully updated.
'400':
content:
application/json:
examples:
protectedFieldsExample:
description: The request attempts to update protected fields without the force query parameter.
summary: Protected fields without force
value:
error: Bad Request
message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type'
statusCode: 400
description: Bad request.
'404':
content:
application/json:
examples:
notFoundExample:
description: No entity with the specified identifier exists.
summary: Entity not found
value:
error: Not Found
message: Entity ID 'user:jane.doe@example.com' not found
statusCode: 404
description: Entity not found.
summary: Update an entity
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity\":{\"id\":\"user:jane.doe@example.com\",\"name\":\"jane.doe\",\"type\":\"user\",\"attributes\":{\"managed\":true,\"mfa_enabled\":true}},\"user\":{\"name\":\"jane.doe\"}}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/user?force=true\"\n"
- lang: Console
source: "PUT kbn://api/security/entity_store/entities/user?force=true\n{\n \"entity\": {\n \"id\": \"user:jane.doe@example.com\",\n \"name\": \"jane.doe\",\n \"type\": \"user\",\n \"attributes\": { \"managed\": true, \"mfa_enabled\": true }\n },\n \"user\": { \"name\": \"jane.doe\" }\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/entities/bulk:
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/entities/bulk
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update multiple entity records in the Entity Store in a single request.
[Required authorization] Route required privileges: securitySolution.'
operationId: put-security-entity-store-entities-bulk
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: When true, allows updating protected fields.
in: query
name: force
required: false
schema:
anyOf:
- enum:
- 'true'
- 'false'
type: string
- type: boolean
default: false
requestBody:
content:
application/json:
examples:
bulkUpdateExample:
description: Update a host entity and a user entity in a single request.
summary: Bulk update multiple entities
value:
entities:
- doc:
entity:
attributes:
asset: true
id: host:web-server-prod-01
name: web-server-prod-01
type: host
host:
name: web-server-prod-01
type: host
- doc:
entity:
attributes:
managed: true
id: user:jane.doe@example.com
name: jane.doe
type: user
user:
name: jane.doe
type: user
schema:
additionalProperties: false
type: object
properties:
entities:
description: The entities to update.
items:
type: object
properties:
doc:
anyOf:
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
tags:
items:
type: string
type: array
user:
additionalProperties: false
type: object
properties:
domain:
items:
type: string
type: array
email:
items:
type: string
type: array
full_name:
items:
type: string
type: array
hash:
items:
type: string
type: array
id:
items:
type: string
type: array
name:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
roles:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
host:
additionalProperties: false
type: object
properties:
architecture:
items:
type: string
type: array
domain:
items:
type: string
type: array
hostname:
items:
type: string
type: array
id:
items:
type: string
type: array
ip:
items:
type: string
type: array
mac:
items:
type: string
type: array
name:
type: string
os:
additionalProperties: false
type: object
properties:
family:
type: string
full:
type: string
kernel:
type: string
name:
anyOf:
- type: string
- items:
type: string
type: array
platform:
type: string
type:
anyOf:
- type: string
- items:
type: string
type: array
version:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
type:
items:
type: string
type: array
labels:
additionalProperties: {}
type: object
properties: {}
tags:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
service:
additionalProperties: false
type: object
properties:
address:
type: string
environment:
type: string
ephemeral_id:
type: string
id:
type: string
name:
type: string
node:
additionalProperties: false
type: object
properties:
name:
type: string
role:
type: string
roles:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
state:
type: string
type:
type: string
version:
type: string
tags:
items:
type: string
type: array
- additionalProperties: false
type: object
properties:
'@timestamp':
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
asset:
additionalProperties: false
type: object
properties:
business_unit:
type: string
criticality:
anyOf:
- enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
- nullable: true
environment:
type: string
id:
type: string
model:
type: string
name:
type: string
owner:
type: string
serial_number:
type: string
vendor:
type: string
cloud:
additionalProperties: false
type: object
properties:
account:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
availability_zone:
type: string
instance:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
machine:
additionalProperties: false
type: object
properties:
type:
type: string
project:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
provider:
type: string
region:
type: string
service:
additionalProperties: false
type: object
properties:
name:
type: string
entity:
additionalProperties: false
type: object
properties:
attributes:
additionalProperties: false
type: object
properties:
asset:
type: boolean
known_redirects:
items:
type: string
type: array
managed:
type: boolean
mfa_enabled:
type: boolean
oauth_consent_restriction:
type: string
permissions:
items:
type: string
type: array
storage_class:
type: string
watchlists:
items:
type: string
type: array
behaviors:
additionalProperties: false
type: object
properties:
anomaly_job_ids:
items:
type: string
type: array
rule_names:
items:
type: string
type: array
EngineMetadata:
additionalProperties: false
type: object
properties:
Type:
type: string
id:
type: string
lifecycle:
additionalProperties: false
type: object
properties:
first_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_activity:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
last_seen:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
name:
type: string
relationships:
additionalProperties: false
type: object
properties:
accesses_frequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
accesses_infrequently:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
administers:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
communicates_with:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
depends_on:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
owns_inferred:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
resolution:
additionalProperties: false
type: object
properties:
resolved_to:
type: string
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
supervises:
additionalProperties: false
type: object
properties:
ids:
items:
type: string
type: array
raw_identifiers:
additionalProperties: false
type: object
properties:
entity.id:
items:
type: string
type: array
host.id:
items:
type: string
type: array
host.name:
items:
type: string
type: array
service.name:
items:
type: string
type: array
user.email:
items:
type: string
type: array
user.id:
items:
type: string
type: array
user.name:
items:
type: string
type: array
risk:
additionalProperties: false
type: object
properties:
calculated_level:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
calculated_score:
type: number
calculated_score_norm:
maximum: 100
minimum: 0
type: number
schema_version:
type: string
source:
items:
type: string
type: array
sub_type:
type: string
type:
type: string
url:
type: string
event:
additionalProperties: false
type: object
properties:
ingested:
format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
type: string
labels:
additionalProperties: {}
type: object
properties: {}
orchestrator:
additionalProperties: false
type: object
properties:
api_version:
type: string
cluster:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
url:
type: string
version:
type: string
namespace:
type: string
organization:
type: string
resource:
additionalProperties: false
type: object
properties:
annotation:
type: string
id:
type: string
ip:
type: string
label:
type: string
name:
type: string
parent:
additionalProperties: false
type: object
properties:
type:
type: string
type:
type: string
type:
type: string
tags:
items:
type: string
type: array
type:
description: The entity type of this record.
enum:
- user
- host
- service
- generic
type: string
required:
- type
- doc
type: array
required:
- entities
responses:
'200':
content:
application/json:
examples:
bulkUpdatePartialExample:
description: Some entities were updated but others encountered Elasticsearch-level errors.
summary: Partial success with errors
value:
errors:
- _id: 5de9f93a68a72532e736bf5a6184b06300b9cabf
reason: '[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing'
status: 404
type: document_missing_exception
ok: true
bulkUpdateSuccessExample:
description: All entities were successfully updated with no errors.
summary: All entities updated
value:
errors: []
ok: true
description: Indicates a successful response.
'400':
content:
application/json:
examples:
protectedFieldsExample:
description: The request attempts to update protected fields without the force query parameter.
summary: Protected fields without force
value:
error: Bad Request
message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type'
statusCode: 400
description: Bad request.
summary: Bulk update entities
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entities\":[{\"type\":\"host\",\"doc\":{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\"}}}]}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true\"\n"
- lang: Console
source: "PUT kbn://api/security/entity_store/entities/bulk?force=true\n{\n \"entities\": [\n {\n \"type\": \"host\",\n \"doc\": {\n \"entity\": {\n \"id\": \"host:web-server-prod-01\",\n \"name\": \"web-server-prod-01\",\n \"type\": \"host\",\n \"attributes\": { \"asset\": true }\n },\n \"host\": { \"name\": \"web-server-prod-01\" }\n }\n }\n ]\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/install:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/install
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Install the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. To change settings after install, use the update endpoint.
[Required authorization] Route required privileges: securitySolution.'
operationId: post-security-entity-store-install
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
installDefaultExample:
description: Install the Entity Store for all entity types with default log extraction settings.
summary: Install with default entity types
value:
entityTypes:
- user
- host
- service
- generic
logExtraction: {}
installWithCustomSettingsExample:
description: Install the Entity Store for host entities only with a custom lookback period and field history length.
summary: Install with custom log extraction
value:
entityTypes:
- host
logExtraction:
delay: 2m
fieldHistoryLength: 20
frequency: 5m
lookbackPeriod: 12h
schema:
additionalProperties: false
type: object
properties:
entityTypes:
default:
- user
- host
- service
- generic
items:
enum:
- user
- host
- service
- generic
type: string
type: array
historySnapshot:
additionalProperties: false
type: object
properties:
frequency:
default: 24h
pattern: '[smdh]$'
type: string
logExtraction:
additionalProperties: false
type: object
properties:
additionalIndexPatterns:
default: []
items:
type: string
type: array
delay:
default: 1m
pattern: '[smdh]$'
type: string
docsLimit:
default: 10000
maximum: 9007199254740991
minimum: 1
type: integer
fieldHistoryLength:
default: 10
maximum: 9007199254740991
minimum: -9007199254740991
type: integer
frequency:
default: 1m
pattern: '[smdh]$'
type: string
lookbackPeriod:
default: 3h
pattern: '[smdh]$'
type: string
maxLogsPerPage:
default: 40000
maximum: 9007199254740991
minimum: 1
type: integer
responses:
'200':
content:
application/json:
examples:
alreadyInstalledExample:
description: All requested entity types were already installed.
summary: Already installed
value:
ok: true
description: Indicates all requested entity types are already installed.
'201':
content:
application/json:
examples:
installSuccessExample:
description: The Entity Store was installed and engines are being created.
summary: Entity Store installed
value:
ok: true
description: Indicates the Entity Store was successfully installed.
'403':
content:
application/json:
examples:
forbiddenExample:
description: The user does not have the required Elasticsearch privileges.
summary: Insufficient privileges
value:
error: Forbidden
message: User 'analyst' has insufficient privileges
statusCode: 403
description: Insufficient privileges.
summary: Install the Entity Store
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"],\"logExtraction\":{}}' \\\n \"${KIBANA_URL}/api/security/entity_store/install\"\n"
- lang: Console
source: "POST kbn://api/security/entity_store/install\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"],\n \"logExtraction\": {}\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/resolution/group:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security/entity_store/resolution/group
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the resolution group for a given entity, returning all linked entities. Requires an enterprise license.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
operationId: get-security-entity-store-resolution-group
parameters:
- description: The entity identifier to look up the resolution group for.
in: query
name: entity_id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
resolutionGroupExample:
description: Returns the resolution group for an entity, including the target entity, all aliases, and the group size.
summary: Resolution group with linked entities
value:
aliases:
- '@timestamp': '2026-04-10T08:25:00.000Z'
entity:
id: user:jdoe@example.com
name: jdoe
relationships:
resolution:
resolved_to: user:jane.doe@example.com
type: user
user:
name: jdoe
group_size: 2
target:
'@timestamp': '2026-04-10T08:30:00.000Z'
entity:
id: user:jane.doe@example.com
name: jane.doe
type: user
user:
email:
- jane.doe@example.com
name: jane.doe
description: Indicates a successful response.
'400':
content:
application/json:
examples:
truncatedSearchExample:
description: The resolution search returned too many results and was truncated.
summary: Search results truncated
value:
error: Bad Request
message: Resolution search truncated
statusCode: 400
description: Bad request.
'404':
content:
application/json:
examples:
notFoundExample:
description: The specified entity does not exist or has no resolution group.
summary: Entity not found
value:
error: Not Found
message: 'Entities not found: [user:nonexistent@example.com]'
statusCode: 404
description: Entity not found.
summary: Get resolution group
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/group?entity_id=user%3Ajane.doe%40example.com\"\n"
- lang: Console
source: 'GET kbn://api/security/entity_store/resolution/group?entity_id=user:jane.doe@example.com
'
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/resolution/link:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/resolution/link
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Link one or more entities to a target entity, creating a resolution group. Requires an enterprise license.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
operationId: post-security-entity-store-resolution-link
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
linkEntitiesExample:
description: Link two user entities to a target entity, creating a resolution group.
summary: Link entities to a target
value:
entity_ids:
- user:jdoe@example.com
- user:j.doe@example.com
target_id: user:jane.doe@example.com
schema:
additionalProperties: false
type: object
properties:
entity_ids:
description: Entity identifiers to link to the target entity. Minimum 1, maximum 1000.
items:
type: string
maxItems: 1000
minItems: 1
type: array
target_id:
description: The entity identifier to resolve the linked entities to.
type: string
required:
- target_id
- entity_ids
responses:
'200':
content:
application/json:
examples:
linkSuccessExample:
description: The entities were successfully linked to the target entity.
summary: Entities linked
value:
linked:
- user:jdoe@example.com
- user:j.doe@example.com
skipped: []
target_id: user:jane.doe@example.com
description: Indicates a successful response.
'400':
content:
application/json:
examples:
mixedTypesExample:
description: All entities in a resolution group must be of the same type.
summary: Mixed entity types
value:
error: Bad Request
message: Cannot link entities of different types
statusCode: 400
selfLinkExample:
description: Cannot link an entity to itself.
summary: Self-link error
value:
error: Bad Request
message: Cannot link entity 'user:jane.doe@example.com' to itself.
statusCode: 400
description: Bad request.
'404':
content:
application/json:
examples:
notFoundExample:
description: One or more of the specified entity identifiers were not found.
summary: Entities not found
value:
error: Not Found
message: 'Entities not found: [user:nonexistent@example.com, user:also-nonexistent@example.com]'
statusCode: 404
description: Entities not found.
summary: Link entities
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"target_id\":\"user:jane.doe@example.com\",\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/link\"\n"
- lang: Console
source: "POST kbn://api/security/entity_store/resolution/link\n{\n \"target_id\": \"user:jane.doe@example.com\",\n \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/resolution/unlink:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/resolution/unlink
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Remove one or more entities from their resolution group. Requires an enterprise license.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
operationId: post-security-entity-store-resolution-unlink
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
unlinkEntitiesExample:
description: Remove entities from their resolution group, restoring them as standalone entities.
summary: Unlink entities from their resolution group
value:
entity_ids:
- user:jdoe@example.com
- user:j.doe@example.com
schema:
additionalProperties: false
type: object
properties:
entity_ids:
description: Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000.
items:
type: string
maxItems: 1000
minItems: 1
type: array
required:
- entity_ids
responses:
'200':
content:
application/json:
examples:
unlinkSuccessExample:
description: The entities were successfully removed from their resolution group.
summary: Entities unlinked
value:
skipped: []
unlinked:
- user:jdoe@example.com
- user:j.doe@example.com
description: Indicates a successful response.
'404':
content:
application/json:
examples:
notFoundExample:
description: One or more of the specified entity identifiers were not found.
summary: Entities not found
value:
error: Not Found
message: 'Entities not found: [user:nonexistent@example.com]'
statusCode: 404
description: Entities not found.
summary: Unlink entities
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/unlink\"\n"
- lang: Console
source: "POST kbn://api/security/entity_store/resolution/unlink\n{\n \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/start:
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/start
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Start previously stopped entity engines, resuming data processing for the specified entity types.
[Required authorization] Route required privileges: securitySolution.'
operationId: put-security-entity-store-start
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
startAllExample:
description: Start all stopped entity engines.
summary: Start all entity engines
value:
entityTypes:
- user
- host
- service
- generic
startSingleExample:
description: Start only the host entity engine.
summary: Start a single entity engine
value:
entityTypes:
- host
schema:
additionalProperties: false
type: object
properties:
entityTypes:
default:
- user
- host
- service
- generic
description: Entity types to start. Defaults to all installed types.
items:
enum:
- user
- host
- service
- generic
type: string
type: array
responses:
'200':
content:
application/json:
examples:
startSuccessExample:
description: The specified entity engines were successfully started.
summary: Engines started
value:
ok: true
description: Indicates a successful response.
summary: Start Entity Store engines
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/start\"\n"
- lang: Console
source: "PUT kbn://api/security/entity_store/start\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/status:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/security/entity_store/status
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the overall Entity Store status and per-engine statuses, optionally including component-level health details.
[Required authorization] Route required privileges: securitySolution.'
operationId: get-security-entity-store-status
parameters:
- description: If true, returns a detailed status of each engine including all its components.
in: query
name: include_components
required: false
schema:
anyOf:
- enum:
- 'true'
- 'false'
type: string
- type: boolean
default: false
responses:
'200':
content:
application/json:
examples:
notInstalledExample:
description: The Entity Store has not been installed.
summary: Entity Store not installed
value:
engines: []
status: not_installed
runningStatusExample:
description: The Entity Store is running with two started engines using default settings.
summary: Entity Store running
value:
engines:
- delay: 1m
docsPerSecond: -1
enrichPolicyExecutionInterval: null
fieldHistoryLength: 10
filter: ''
frequency: 30s
indexPattern: ''
lastExecutionTimestamp: '2026-04-10T08:30:00.000Z'
lookbackPeriod: 3h
maxPageSearchSize: 10000
status: started
timeout: 25s
timestampField: '@timestamp'
type: host
- delay: 1m
docsPerSecond: -1
enrichPolicyExecutionInterval: null
fieldHistoryLength: 10
filter: ''
frequency: 30s
indexPattern: ''
lastExecutionTimestamp: '2026-04-10T08:30:00.000Z'
lookbackPeriod: 3h
maxPageSearchSize: 10000
status: started
timeout: 25s
timestampField: '@timestamp'
type: user
status: running
description: Indicates a successful response.
summary: Get Entity Store status
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/status?include_components=false\"\n"
- lang: Console
source: 'GET kbn://api/security/entity_store/status?include_components=false
'
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/stop:
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/security/entity_store/stop
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Stop running entity engines, pausing data processing for the specified entity types.
[Required authorization] Route required privileges: securitySolution.'
operationId: put-security-entity-store-stop
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
stopAllExample:
description: Stop all running entity engines.
summary: Stop all entity engines
value:
entityTypes:
- user
- host
- service
- generic
schema:
additionalProperties: false
type: object
properties:
entityTypes:
default:
- user
- host
- service
- generic
description: Entity types to stop. Defaults to all running types.
items:
enum:
- user
- host
- service
- generic
type: string
type: array
responses:
'200':
content:
application/json:
examples:
stopSuccessExample:
description: The specified entity engines were successfully stopped.
summary: Engines stopped
value:
ok: true
description: Indicates a successful response.
summary: Stop Entity Store engines
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/stop\"\n"
- lang: Console
source: "PUT kbn://api/security/entity_store/stop\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security/entity_store/uninstall:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/security/entity_store/uninstall
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Uninstall the Entity Store, removing engines and associated resources for the specified entity types.
[Required authorization] Route required privileges: securitySolution.'
operationId: post-security-entity-store-uninstall
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
uninstallAllExample:
description: Uninstall all entity engines from the Entity Store.
summary: Uninstall all entity types
value:
entityTypes:
- user
- host
- service
- generic
uninstallSingleExample:
description: Uninstall only the host engine from the Entity Store.
summary: Uninstall a single entity type
value:
entityTypes:
- host
schema:
additionalProperties: false
type: object
properties:
entityTypes:
default:
- user
- host
- service
- generic
description: Entity types to uninstall. Defaults to all installed types.
items:
enum:
- user
- host
- service
- generic
type: string
type: array
responses:
'200':
content:
application/json:
examples:
uninstallSuccessExample:
description: The specified entity engines were successfully uninstalled.
summary: Entity Store uninstalled
value:
ok: true
description: Indicates a successful response.
summary: Uninstall the Entity Store
tags:
- Security entity store
x-codeSamples:
- lang: curl
source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/uninstall\"\n"
- lang: Console
source: "POST kbn://api/security/entity_store/uninstall\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
x-metaTags:
- content: Kibana
name: product_name
components:
securitySchemes:
apiKeyAuth:
description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
'
in: header
name: Authorization
type: apiKey
basicAuth:
scheme: basic
type: http
x-topics:
- title: Kibana spaces
content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"