Install the Entity Store

Base URL
https://{kibana_url}
  • POST /api/security/entity_store/install
  • POST /s/{space_id}/api/security/entity_store/install
Auth

Install the Entity Store and create engines for the specified entity types. logExtraction sets overrides that apply to all entity types, on top of built-in defaults per entity type. The default frequency is 1m for host and user, 10m for service and 30m for generic. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the entity type default. To change settings after install, use the update endpoint.

Required privileges

Privileges securitySolution

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

entityTypes enum[] · default: [ "user", "host", "service", "generic" ]
Values: user host service generic
excludedUserNames string[] · max items: 200
historySnapshot object
frequency string · max length: 32 · pattern: [smdh]$
retentionDays integer · min: 1 · max: 3650
logExtraction object
additionalIndexPatterns string[] · max items: 1000 nullable
delay string · max length: 32 · pattern: [smdh]$ nullable
docsLimit integer · min: 1 · max: 9007199254740991 nullable
excludedIndexPatterns string[] · max items: 1000 nullable
fieldHistoryLength integer · min: -9007199254740991 · max: 9007199254740991 nullable
frequency string · max length: 32 · pattern: [smdh]$ nullable
lookbackPeriod string · max length: 32 · pattern: [smdh]$ nullable
maxLogsPerPage integer · min: 1 · max: 9007199254740991 nullable
maxLogsPerWindow integer · min: 0 · max: 9007199254740991 nullable
maxLogsPerWindowCapBehavior enum nullable
Values: defer drop
maxTimeWindowSize string · max length: 32 · pattern: [smdh]$ nullable

Responses

200

Indicates all requested entity types are already installed.

application/json
201

Indicates the Entity Store was successfully installed.

application/json
403

Insufficient privileges.

application/json
Base URL
https://{kibana_url}