Create a new watchlist

Base URL
https://{kibana_url}
  • POST /api/entity_analytics/watchlists
  • POST /s/{space_id}/api/entity_analytics/watchlists
Auth

Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

description string · max length: 1000

Description of the watchlist

entitySources object[] · max items: 100

Optional entity sources to create and link to the watchlist

enabled boolean
filter object
kuery union oneOf
One of: string or object
identifierField string · max length: 256

Field used to query the entity store for index-type sources

indexPattern string · max length: 1000
integrationName string · max length: 256

Required when type is entity_analytics_integration. One of entityanalytics_okta, entityanalytics_ad.

matchers object[] · max items: 100
fields string[] · max items: 100 required
values union string[] | boolean[] required

Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.

name string · max length: 256 required
queryRule string · max length: 4096

KQL query used to filter data from the provided index patterns

range object

Defines the lookback period for filtering source data by timestamp.

end string · max length: 256 required

End of the lookback period (date math or ISO string, e.g. "now")

start string · max length: 256 required

Start of the lookback period (date math or ISO string, e.g. "now-10d")

type enum required
Values: index entity_analytics_integration store
managed boolean

Indicates if the watchlist is managed by the system

name string · max length: 256 required

Unique name for the watchlist

riskModifier number · min: 0 · max: 2 required

Risk score modifier associated with the watchlist

Response

Watchlist created successfully

application/json
createdAt string · format: date-time

Timestamp indicating when the watchlist was created

description string

Description of the watchlist

entityCount number

Number of entities in the watchlist

entitySourceIds string[]

List of entity source IDs associated with the watchlist

hasManualEntities boolean

Indicates whether the watchlist contains manually assigned entities

id string

The unique ID of the watchlist

managed boolean required

Indicates if the watchlist is managed by the system

name string required

The name of the watchlist

riskModifier number required

Risk score modifier associated with the watchlist

updatedAt string · format: date-time

Timestamp indicating when the watchlist was last updated

entitySources object[]
enabled boolean
filter object
kuery union oneOf
One of: string or object
identifierField string · max length: 256

Field used to query the entity store for index-type sources

indexPattern string · max length: 1000
integrationName string · max length: 256
integrations object
syncData object

integrations latest full sync and update syncData

lastFullSync string · format: date-time

Timestamp of the last full sync from integrations

lastUpdateProcessed string · format: date-time

Timestamp of the last update processed from integrations

syncMarkerIndex string · max length: 1000

Index to read latest sync markers from

matchers object[] · max items: 100
fields string[] · max items: 100 required
values union string[] | boolean[] required

Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.

name string · max length: 256 required
queryRule string · max length: 4096

KQL query used to filter data from the provided index patterns

range object

Defines the lookback period for filtering source data by timestamp.

end string · max length: 256 required

End of the lookback period (date math or ISO string, e.g. "now")

start string · max length: 256 required

Start of the lookback period (date math or ISO string, e.g. "now-10d")

type enum required
Values: index entity_analytics_integration store
managed boolean required
apiKeyId string · max length: 64 nullable

ID of the API key used for scoped reads from the source index. Only present for index-type sources.

id string required
Base URL
https://{kibana_url}