Update the Entity Store

Base URL: https://{kibana_url}

PUT /api/security/entity_store
PUT /s/{space_id}/api/security/entity_store

Auth

Update the Entity Store configuration without reinstalling. Send logExtraction to change log extraction settings. Omitting a log extraction field leaves it unchanged. Sending null for a log extraction field clears that override and reverts to the entity type default (for frequency: 1m for host and user, 10m for service, 30m for generic). Send historySnapshot.frequency to change the snapshot interval (at least 1 hour) and historySnapshot.retentionDays to change how long snapshots are kept. Omitting either history snapshot field leaves it unchanged. At least one of logExtraction, excludedUserNames or historySnapshot is required.

Required privileges

Privileges securitySolution

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

excludedUserNames string[] · max items: 200
historySnapshot object
logExtraction object

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json

404

Entity Store not found.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 4 languages

Console Kibana Dev Tools

PUT kbn://api/security/entity_store
{
  "logExtraction": {
    "lookbackPeriod": "6h",
    "frequency": "10m",
    "fieldHistoryLength": 15
  }
}

Console Kibana Dev Tools

PUT kbn://api/security/entity_store
{
  "historySnapshot": {
    "frequency": "12h",
    "retentionDays": 90
  }
}

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"logExtraction":{"lookbackPeriod":"6h","frequency":"10m","fieldHistoryLength":15}}' \
  "${KIBANA_URL}/api/security/entity_store"

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"historySnapshot":{"frequency":"12h","retentionDays":90}}' \
  "${KIBANA_URL}/api/security/entity_store"

Response

No example

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Request Console 1 / 2 languages

Send null for any field to clear that override and revert it to the entity type default. For frequency, that is 1m for host and user, 10m for service and 30m for generic.

Console Kibana Dev Tools

PUT kbn:/api/security/entity_store
{
  "logExtraction": {
    "delay": "null",
    "frequency": "null"
  }
}

Generated from the API spec

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "logExtraction": {
      "delay": "null",
      "frequency": "null"
    }
  }' \
  "${KIBANA_URL}/api/security/entity_store"

Generated from the API spec

Response

The Entity Store configuration was successfully updated.

{
  "ok": true
}

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Request Console 1 / 2 languages

Update the history snapshot interval and retention. Omit a field to leave it unchanged.

Console Kibana Dev Tools

PUT kbn:/api/security/entity_store
{
  "historySnapshot": {
    "frequency": "12h",
    "retentionDays": 90
  }
}

Generated from the API spec

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "historySnapshot": {
      "frequency": "12h",
      "retentionDays": 90
    }
  }' \
  "${KIBANA_URL}/api/security/entity_store"

Generated from the API spec

Response

The Entity Store configuration was successfully updated.

{
  "ok": true
}

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Request Console 1 / 2 languages

Update the log extraction configuration with a new lookback period and frequency.

Console Kibana Dev Tools

PUT kbn:/api/security/entity_store
{
  "logExtraction": {
    "fieldHistoryLength": 15,
    "frequency": "10m",
    "lookbackPeriod": "6h"
  }
}

Generated from the API spec

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "logExtraction": {
      "fieldHistoryLength": 15,
      "frequency": "10m",
      "lookbackPeriod": "6h"
    }
  }' \
  "${KIBANA_URL}/api/security/entity_store"

Generated from the API spec

Response

The Entity Store configuration was successfully updated.

{
  "ok": true
}

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}