Create a new watchlist
https://{kibana_url}
- POST /api/entity_analytics/watchlists
Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities.
Request
-
descriptionstring · max: 1000 -
Description of the watchlist
-
entitySourcesobject · max: 100 -
Optional entity sources to create and link to the watchlist
-
enabledboolean -
identifierFieldstring · max: 256 -
Field used to query the entity store for index-type sources
-
indexPatternstring · max: 1000 -
integrationNamestring · max: 256 -
Required when type is entity_analytics_integration. One of entityanalytics_okta, entityanalytics_ad.
-
matchersobject · max: 100 -
fieldsstring · max: 100required -
valuesstring | booleanrequired -
Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.
-
namestring · max: 256required -
queryRulestring · max: 4096 -
KQL query used to filter data from the provided index patterns
-
range -
Defines the lookback period for filtering source data by timestamp.
-
type -
Values:
indexentity_analytics_integrationstore -
managedboolean -
Indicates if the watchlist is managed by the system
-
namestring · max: 256required -
Unique name for the watchlist
-
riskModifiernumber · min: 0 · max: 2required -
Risk score modifier associated with the watchlist
Response
Watchlist created successfully
-
createdAtstring -
Timestamp indicating when the watchlist was created
-
descriptionstring -
Description of the watchlist
-
entityCountnumber -
Number of entities in the watchlist
-
entitySourceIdsstring -
List of entity source IDs associated with the watchlist
-
hasManualEntitiesboolean -
Indicates whether the watchlist contains manually assigned entities
-
idstring -
The unique ID of the watchlist
-
managedbooleanrequired -
Indicates if the watchlist is managed by the system
-
namestringrequired -
The name of the watchlist
-
riskModifiernumberrequired -
Risk score modifier associated with the watchlist
-
updatedAtstring -
Timestamp indicating when the watchlist was last updated
-
entitySourcesobject -
enabledboolean -
identifierFieldstring · max: 256 -
Field used to query the entity store for index-type sources
-
indexPatternstring · max: 1000 -
integrationNamestring · max: 256 -
integrations -
syncDataobject -
integrations latest full sync and update syncData
-
lastFullSyncstring -
Timestamp of the last full sync from integrations
-
lastUpdateProcessedstring -
Timestamp of the last update processed from integrations
-
syncMarkerIndexstring · max: 1000 -
Index to read latest sync markers from
-
matchersobject · max: 100 -
fieldsstring · max: 100required -
valuesstring | booleanrequired -
Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.
-
namestring · max: 256required -
queryRulestring · max: 4096 -
KQL query used to filter data from the provided index patterns
-
range -
Defines the lookback period for filtering source data by timestamp.
-
type -
Values:
indexentity_analytics_integrationstore -
managedbooleanrequired -
apiKeyIdstring · max: 64nullable -
ID of the API key used for scoped reads from the source index. Only present for index-type sources.
-
idstringrequired