List all monitored users

deprecated

Server: https://{kibana_url}

GET /api/entity_analytics/monitoring/users/list
GET /s/{space_id}/api/entity_analytics/monitoring/users/list

Api key auth Basic auth

Refer to Spaces for more information.

Deprecated in 9.4.0. Use the Watchlists API instead.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

Query Parameters

kql string: KQL query to filter the list of monitored users

Response

List of monitored users

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/entity_analytics/monitoring/users/list

curl Shell

curl -X GET "https://{kibana_url}/api/entity_analytics/monitoring/users/list"

Response

[
  {
    "@timestamp": "2026-01-28T12:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "api",
          "value": "IT"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-28T12:00:00.000Z"
    },
    "id": "user-abc-123",
    "user": {
      "is_privileged": true,
      "name": "john.doe"
    }
  },
  {
    "@timestamp": "2026-01-15T09:00:00.000Z",
    "entity_analytics_monitoring": {
      "labels": [
        {
          "field": "department",
          "source": "csv",
          "value": "Security"
        }
      ]
    },
    "event": {
      "ingested": "2026-01-15T09:00:00.000Z"
    },
    "id": "user-def-456",
    "user": {
      "is_privileged": true,
      "name": "jane.smith"
    }
  }
]