Upload a CSV file to add entities to a watchlist

Server: https://{kibana_url}
  • POST /api/entity_analytics/watchlists/{watchlist_id}/csv_upload
  • POST /s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/csv_upload
Api key auth

Refer to Spaces for more information.

Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row with a "type" column (user, host, service, or generic) and one or more ECS identity fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.

Matched entities are added to the watchlist and their entity.attributes.watchlists field is updated in the entity store.

Each row will match up to 10,000 entities.

Path Parameters

watchlist_id string required

The ID of the watchlist to add entities to

Request

file string required

The CSV file to upload.

Responses

413

File too large