Bulk update entities
https://{kibana_url}
- PUT /api/security/entity_store/entities/bulk
- PUT /s/{space_id}/api/security/entity_store/entities/bulk
Refer to Spaces for more information.
Update multiple entity records in the Entity Store in a single request.
[Required authorization] Route required privileges: securitySolution.
Query Parameters
-
forceenum | boolean · default: false When true, allows updating protected fields.
-
Values:
truefalse
Request
-
entitiesobjectrequired -
The entities to update.
-
docanyOf -
@timestampstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
The time the entity record was last updated.
-
assetobject -
business_unitstring -
Business unit the asset belongs to.
-
criticality -
The criticality level assigned to this asset.
-
Values:
low_impactmedium_impacthigh_impactextreme_impact -
environmentstring -
Deployment environment (for example, production, staging).
-
idstring -
Unique identifier for the asset.
-
modelstring -
Model name or number.
-
namestring -
Human-readable asset name.
-
ownerstring -
The owner of the asset.
-
serial_numberstring -
Serial number of the asset.
-
vendorstring -
Vendor or manufacturer.
-
entityobject -
attributesobject -
Boolean flags describing characteristics of the entity.
-
assetboolean -
Whether the entity is classified as an asset.
-
known_redirectsstring -
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managedboolean -
Whether the entity is managed (for example, via a directory service).
-
mfa_enabledboolean -
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restrictionstring -
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissionsstring -
Action-level permissions granted to this entity (not roles or groups).
-
storage_classstring -
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlistsstring -
Watchlist identifiers the entity belongs to (v2).
-
behaviorsobject -
Behavioral signals observed for the entity.
-
anomaly_job_idsstring -
Machine learning anomaly job identifiers (v2).
-
rule_namesstring -
Detection rule names that flagged this entity (v2).
-
created_bystring -
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadataobject -
Typestring -
The engine type that produced this entity record.
-
idstring -
Unique identifier for this entity.
-
lifecycleobject -
Timestamps tracking the entity lifecycle.
-
first_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was first observed.
-
last_activitystring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity last generated activity.
-
last_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was last observed.
-
namestring -
Human-readable name of the entity.
-
relationshipsobject -
Connections between this entity and other entities.
-
accesses_frequentlyobject -
Entities this entity accesses frequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
accesses_infrequentlyobject -
Entities this entity accesses infrequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
administersobject -
Entities this entity administers (for example, a user who is an admin of a service).
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
communicates_withobject -
Entities this entity communicates with.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
depends_onobject -
Entities this entity depends on.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
ownsobject -
Entities owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
owns_inferredobject -
Entities inferred to be owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
resolutionobject -
Resolution metadata linking this entity to another.
-
resolved_tostring -
entity.id of the entity this one resolves to
-
riskobject -
Aggregated risk score for the resolution group.
-
calculated_level -
Lexical description of the resolution group's aggregated risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the resolution group's aggregated risk score.
-
supervisesobject -
Entities supervised by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
riskobject -
Risk scoring information for the entity.
-
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_versionstring -
Schema version of the entity record.
-
sourcestring -
Sources that produced this entity record.
-
sub_typestring -
Optional sub-type classification for the entity.
-
typestring -
The entity type.
-
urlstring -
URL associated with the entity.
-
eventobject -
ingestedstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the event was ingested into Elasticsearch.
-
labelsmap string to object -
Custom key-value labels attached to the entity.
-
Tags attached to the entity.
-
userobject -
Elastic Common Schema (ECS) user fields collected on the entity.
-
domainstring -
Observed user domains.
-
emailstring -
Observed email addresses.
-
full_namestring -
Observed full names of the user.
-
hashstring -
Observed user hashes.
-
idstring -
Observed user identifiers.
-
namestring -
Primary user name.
-
riskobject -
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score.
-
rolesstring -
Observed roles assigned to the user.
-
@timestampstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
The time the entity record was last updated.
-
assetobject -
business_unitstring -
Business unit the asset belongs to.
-
criticality -
The criticality level assigned to this asset.
-
Values:
low_impactmedium_impacthigh_impactextreme_impact -
environmentstring -
Deployment environment (for example, production, staging).
-
idstring -
Unique identifier for the asset.
-
modelstring -
Model name or number.
-
namestring -
Human-readable asset name.
-
ownerstring -
The owner of the asset.
-
serial_numberstring -
Serial number of the asset.
-
vendorstring -
Vendor or manufacturer.
-
entityobject -
attributesobject -
Boolean flags describing characteristics of the entity.
-
assetboolean -
Whether the entity is classified as an asset.
-
known_redirectsstring -
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managedboolean -
Whether the entity is managed (for example, via a directory service).
-
mfa_enabledboolean -
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restrictionstring -
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissionsstring -
Action-level permissions granted to this entity (not roles or groups).
-
storage_classstring -
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlistsstring -
Watchlist identifiers the entity belongs to (v2).
-
behaviorsobject -
Behavioral signals observed for the entity.
-
anomaly_job_idsstring -
Machine learning anomaly job identifiers (v2).
-
rule_namesstring -
Detection rule names that flagged this entity (v2).
-
created_bystring -
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadataobject -
Typestring -
The engine type that produced this entity record.
-
idstring -
Unique identifier for this entity.
-
lifecycleobject -
Timestamps tracking the entity lifecycle.
-
first_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was first observed.
-
last_activitystring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity last generated activity.
-
last_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was last observed.
-
namestring -
Human-readable name of the entity.
-
relationshipsobject -
Connections between this entity and other entities.
-
accesses_frequentlyobject -
Entities this entity accesses frequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
accesses_infrequentlyobject -
Entities this entity accesses infrequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
administersobject -
Entities this entity administers (for example, a user who is an admin of a service).
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
communicates_withobject -
Entities this entity communicates with.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
depends_onobject -
Entities this entity depends on.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
ownsobject -
Entities owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
owns_inferredobject -
Entities inferred to be owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
resolutionobject -
Resolution metadata linking this entity to another.
-
resolved_tostring -
entity.id of the entity this one resolves to
-
riskobject -
Aggregated risk score for the resolution group.
-
calculated_level -
Lexical description of the resolution group's aggregated risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the resolution group's aggregated risk score.
-
supervisesobject -
Entities supervised by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
riskobject -
Risk scoring information for the entity.
-
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_versionstring -
Schema version of the entity record.
-
sourcestring -
Sources that produced this entity record.
-
sub_typestring -
Optional sub-type classification for the entity.
-
typestring -
The entity type.
-
urlstring -
URL associated with the entity.
-
eventobject -
ingestedstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the event was ingested into Elasticsearch.
-
hostobject -
Elastic Common Schema (ECS) host fields collected on the entity.
-
architecturestring -
Observed CPU architectures.
-
domainstring -
Observed host domains.
-
hostnamestring -
Observed hostnames.
-
idstring -
Observed host identifiers.
-
ipstring -
Observed IP addresses.
-
macstring -
Observed MAC addresses.
-
namestring -
Primary host name.
-
osobject -
Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
-
riskobject -
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score.
-
typestring -
Observed host types.
-
labelsmap string to object -
Custom key-value labels attached to the entity.
-
Tags attached to the entity.
-
@timestampstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
The time the entity record was last updated.
-
assetobject -
business_unitstring -
Business unit the asset belongs to.
-
criticality -
The criticality level assigned to this asset.
-
Values:
low_impactmedium_impacthigh_impactextreme_impact -
environmentstring -
Deployment environment (for example, production, staging).
-
idstring -
Unique identifier for the asset.
-
modelstring -
Model name or number.
-
namestring -
Human-readable asset name.
-
ownerstring -
The owner of the asset.
-
serial_numberstring -
Serial number of the asset.
-
vendorstring -
Vendor or manufacturer.
-
entityobject -
attributesobject -
Boolean flags describing characteristics of the entity.
-
assetboolean -
Whether the entity is classified as an asset.
-
known_redirectsstring -
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managedboolean -
Whether the entity is managed (for example, via a directory service).
-
mfa_enabledboolean -
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restrictionstring -
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissionsstring -
Action-level permissions granted to this entity (not roles or groups).
-
storage_classstring -
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlistsstring -
Watchlist identifiers the entity belongs to (v2).
-
behaviorsobject -
Behavioral signals observed for the entity.
-
anomaly_job_idsstring -
Machine learning anomaly job identifiers (v2).
-
rule_namesstring -
Detection rule names that flagged this entity (v2).
-
created_bystring -
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadataobject -
Typestring -
The engine type that produced this entity record.
-
idstring -
Unique identifier for this entity.
-
lifecycleobject -
Timestamps tracking the entity lifecycle.
-
first_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was first observed.
-
last_activitystring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity last generated activity.
-
last_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was last observed.
-
namestring -
Human-readable name of the entity.
-
relationshipsobject -
Connections between this entity and other entities.
-
accesses_frequentlyobject -
Entities this entity accesses frequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
accesses_infrequentlyobject -
Entities this entity accesses infrequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
administersobject -
Entities this entity administers (for example, a user who is an admin of a service).
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
communicates_withobject -
Entities this entity communicates with.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
depends_onobject -
Entities this entity depends on.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
ownsobject -
Entities owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
owns_inferredobject -
Entities inferred to be owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
resolutionobject -
Resolution metadata linking this entity to another.
-
resolved_tostring -
entity.id of the entity this one resolves to
-
riskobject -
Aggregated risk score for the resolution group.
-
calculated_level -
Lexical description of the resolution group's aggregated risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the resolution group's aggregated risk score.
-
supervisesobject -
Entities supervised by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
riskobject -
Risk scoring information for the entity.
-
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_versionstring -
Schema version of the entity record.
-
sourcestring -
Sources that produced this entity record.
-
sub_typestring -
Optional sub-type classification for the entity.
-
typestring -
The entity type.
-
urlstring -
URL associated with the entity.
-
eventobject -
ingestedstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the event was ingested into Elasticsearch.
-
labelsmap string to object -
Custom key-value labels attached to the entity.
-
serviceobject -
Elastic Common Schema (ECS) service fields collected on the entity.
-
addressstring -
Service address.
-
environmentstring -
Service environment (for example, production, staging).
-
ephemeral_idstring -
Ephemeral identifier of the service.
-
idstring -
Unique identifier of the service.
-
namestring -
Primary service name.
-
nodeobject -
Node information for the service.
-
riskobject -
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score.
-
statestring -
Current state of the service.
-
typestring -
Service type.
-
versionstring -
Service version.
-
Tags attached to the entity.
-
@timestampstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
The time the entity record was last updated.
-
assetobject -
business_unitstring -
Business unit the asset belongs to.
-
criticality -
The criticality level assigned to this asset.
-
Values:
low_impactmedium_impacthigh_impactextreme_impact -
environmentstring -
Deployment environment (for example, production, staging).
-
idstring -
Unique identifier for the asset.
-
modelstring -
Model name or number.
-
namestring -
Human-readable asset name.
-
ownerstring -
The owner of the asset.
-
serial_numberstring -
Serial number of the asset.
-
vendorstring -
Vendor or manufacturer.
-
cloudobject -
Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
-
entityobject -
attributesobject -
Boolean flags describing characteristics of the entity.
-
assetboolean -
Whether the entity is classified as an asset.
-
known_redirectsstring -
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managedboolean -
Whether the entity is managed (for example, via a directory service).
-
mfa_enabledboolean -
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restrictionstring -
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissionsstring -
Action-level permissions granted to this entity (not roles or groups).
-
storage_classstring -
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlistsstring -
Watchlist identifiers the entity belongs to (v2).
-
behaviorsobject -
Behavioral signals observed for the entity.
-
anomaly_job_idsstring -
Machine learning anomaly job identifiers (v2).
-
rule_namesstring -
Detection rule names that flagged this entity (v2).
-
created_bystring -
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadataobject -
Typestring -
The engine type that produced this entity record.
-
idstring -
Unique identifier for this entity.
-
lifecycleobject -
Timestamps tracking the entity lifecycle.
-
first_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was first observed.
-
last_activitystring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity last generated activity.
-
last_seenstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
When the entity was last observed.
-
namestring -
Human-readable name of the entity.
-
relationshipsobject -
Connections between this entity and other entities.
-
accesses_frequentlyobject -
Entities this entity accesses frequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
accesses_infrequentlyobject -
Entities this entity accesses infrequently.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
administersobject -
Entities this entity administers (for example, a user who is an admin of a service).
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
communicates_withobject -
Entities this entity communicates with.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
depends_onobject -
Entities this entity depends on.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
ownsobject -
Entities owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
owns_inferredobject -
Entities inferred to be owned by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
resolutionobject -
Resolution metadata linking this entity to another.
-
resolved_tostring -
entity.id of the entity this one resolves to
-
riskobject -
Aggregated risk score for the resolution group.
-
calculated_level -
Lexical description of the resolution group's aggregated risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the resolution group's aggregated risk score.
-
supervisesobject -
Entities supervised by this entity.
-
idsstring -
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiersobject -
entity.idstring -
host.idstring -
host.namestring -
service.namestring -
user.emailstring -
user.idstring -
user.namestring -
riskobject -
Risk scoring information for the entity.
-
calculated_level -
Lexical description of the entity's risk.
-
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
The raw numeric value of the given entity's risk score.
-
calculated_score_normnumber · min: 0 · max: 100 -
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_versionstring -
Schema version of the entity record.
-
sourcestring -
Sources that produced this entity record.
-
sub_typestring -
Optional sub-type classification for the entity.
-
typestring -
The entity type.
-
urlstring -
URL associated with the entity.
-
eventobject -
ingestedstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ -
labelsmap string to object -
orchestratorobject -
Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
Responses
Indicates a successful response.
Bad request.