List entities

Server: https://{kibana_url}

GET /api/security/entity_store/entities

List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.

[Required authorization] Route required privileges: securitySolution.

Query Parameters

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json

Examples

No entities matched the query.

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc

curl Shell

curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
  "${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc"

Response

{
  "page": 1,
  "per_page": 10,
  "records": [],
  "total": 0
}

{
  "error": "Bad Request",
  "message": "Invalid filter: Expected \u0022(\u0022, \u0022{\u0022, value, whitespace but \u0022:\u0022 found.\ninvalid :: query\n---------^",
  "statusCode": 400
}

Query Parameters { filter , size , searchAfter , source , fields , sort_field , sort_order , page , per_page , filterQuery , entity_types , }

Responses

Query Parameters