List entity resolution rules

Server: https://{kibana_url}

GET /api/security/entity_store/resolution/rules
GET /s/{space_id}/api/security/entity_store/resolution/rules

Refer to Spaces for more information.

List managed entity resolution rules and their effective enabled state for this space. Each rule description states what it bridges, which data sources it needs, and when to disable it.

[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.

Response

200

Entity resolution rules.

application/json

Examples

Lists the managed resolution rules and their enabled state in the current space.

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/security/entity_store/resolution/rules

curl Shell

curl -X GET "https://{kibana_url}/api/security/entity_store/resolution/rules"

Response

{
  "rules": [
    {
      "description": "Links user entities that share the same email address, compared case-insensitively, across identity providers. Several \u0060local\u0060 users with that email (one per user name per host) are linked too. Unlinked users in the same identity provider that share an address are left unlinked. Disable if shared mailboxes or role accounts produce false links.",
      "enabled": true,
      "id": "email_exact_match",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links user entities that share the same SID (\u0060user.id\u0060), including several \u0060local\u0060 Windows or CrowdStrike endpoint users on different hosts. Windows domain accounts seen on several hosts are linked even before the Active Directory user is ingested; Active Directory entity analytics is needed only to link or retarget to that AD user once it arrives. A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. Needs Windows or CrowdStrike endpoint events (which create \u0060local\u0060 user entities). Disable if well-known SID exclusions are not enough for your environment.",
      "enabled": true,
      "id": "windows_sid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Microsoft Defender (\u0060m365_defender\u0060) identities to Entra ID by GUID-shaped \u0060user.id\u0060. Needs Defender identity events and Entra entity analytics. Disable if Defender SID IAM events leak through the GUID gate.",
      "enabled": true,
      "id": "entra_guid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links leftover CrowdStrike-namespace user entities to Active Directory by SID (\u0060user.id\u0060). A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. CrowdStrike FDR events now create \u0060local\u0060 entities, which the Windows SID bridge covers. Disabled by default because the crowdstrike namespace no longer receives entities; enable if leftover CrowdStrike-namespace users should still link.",
      "enabled": false,
      "id": "crowdstrike_sid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Microsoft 365 audit actors (\u0060user.id\u0060 UPN) to Entra users (\u0060user.name\u0060 UPN), compared case-insensitively. Needs o365 audit events that create user entities (\u0060event.kind: asset\u0060) and Entra entity analytics. Disabled by default because those events currently do not create entities; enable if your environment emits them as asset events.",
      "enabled": false,
      "id": "upn_cross_field_bridge",
      "kind": "cross_field",
      "managed": true
    },
    {
      "description": "Related user alias resolution across identity providers",
      "enabled": false,
      "id": "related_user_alias_resolution",
      "kind": "related_user_alias_resolution",
      "managed": true
    }
  ]
}