Upload a CSV file to add entities to a watchlist
https://{kibana_url}
- POST /api/entity_analytics/watchlists/{watchlist_id}/csv_upload
- POST /s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/csv_upload
Refer to Spaces for more information.
Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row with a "type" column (user, host, service, or generic) and one or more ECS identity fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.
Matched entities are added to the watchlist and their entity.attributes.watchlists
field is updated in the entity store.
Each row will match up to 10,000 entities.
Path Parameters
-
watchlist_idstringrequired -
The ID of the watchlist to add entities to
Responses
Upload successful
-
failedintegerrequired -
Number of rows that failed to process
-
itemsobjectrequired -
errorstring -
Error message if the row failed to process
-
matchedEntitiesintegerrequired -
Number of entities matched for this row
-
status -
Values:
successfailureunmatched -
successfulintegerrequired -
Number of rows that matched at least one entity
-
totalintegerrequired -
Total number of rows processed
-
unmatchedintegerrequired -
Number of rows that matched no entities
File too large