Link entities

Base URL: https://{kibana_url}

POST /api/security/entity_store/resolution/link
POST /s/{space_id}/api/security/entity_store/resolution/link

Auth

Link one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).

Required privileges

Privileges securitySolution and securitySolution-entity-analytics

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

entity_ids string[] · min items: 1 · max items: 1000 required: Entity identifiers to link to the target entity. Minimum 1, maximum 1000.
target_id string required: The entity identifier to resolve the linked entities to.

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn://api/security/entity_store/resolution/link
{
  "target_id": "user:jane.doe@example.com",
  "entity_ids": ["user:jdoe@example.com"]
}

curl Shell

curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"target_id":"user:jane.doe@example.com","entity_ids":["user:jdoe@example.com"]}' \
  "${KIBANA_URL}/api/security/entity_store/resolution/link"

Response

No example

{
  "error": "Bad Request",
  "message": "Cannot link entities of different types",
  "statusCode": 400
}