Configure the Risk Engine Saved Object

Server: https://{kibana_url}

PATCH /api/risk_score/engine/saved_object/configure

Api key auth Basic auth

Configuring the Risk Engine Saved Object

Request

Responses

Successful response

application/json

Task manager is unavailable

application/json

Unexpected error

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PATCH /api/risk_score/engine/saved_object/configure
{
  "enable_reset_to_zero": false,
  "exclude_alert_statuses": [
    "closed"
  ],
  "exclude_alert_tags": [
    "low-priority"
  ],
  "filters": [
    {
      "entity_types": [
        "host",
        "user"
      ],
      "filter": "host.name: *"
    }
  ],
  "range": {
    "end": "now",
    "start": "now-30d"
  }
}

curl Shell

curl -X PATCH "https://{kibana_url}/api/risk_score/engine/saved_object/configure" \
  -H "Content-Type: application/json" \
  -d '{
  "enable_reset_to_zero": false,
  "exclude_alert_statuses": [
    "closed"
  ],
  "exclude_alert_tags": [
    "low-priority"
  ],
  "filters": [
    {
      "entity_types": [
        "host",
        "user"
      ],
      "filter": "host.name: *"
    }
  ],
  "range": {
    "end": "now",
    "start": "now-30d"
  }
}'

Response

{
  "risk_engine_saved_object_configured": true
}

{
  "message": "Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.",
  "status_code": 400
}

{
  "errors": [
    {
      "error": "Internal server error",
      "seq": 1
    }
  ],
  "risk_engine_saved_object_configured": false
}

Request { enable_reset_to_zero , exclude_alert_statuses , exclude_alert_tags , filters , page_size , range , }

Responses

Request