Get risk score history for an entity
https://{kibana_url}
- GET /api/risk_score/history
Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.
Query Parameters
-
entity_idstring · max: 1000required The identifier of the entity to retrieve history for.
-
fromstring · max: 100 · default: now-90d Start of the time range, in date-math syntax. Defaults to 90 days ago.
-
tostring · max: 100 · default: now End of the time range, in date-math syntax. Defaults to now.
-
score_type Filter entries by the type of score recorded (
base,propagated, orresolution).-
Values:
basepropagatedresolution -
include_contributionsboolean · default: false When true, each entry also includes the contributions recorded for that scoring run (
inputs,modifiers, category 2 fields, andcriticality_level), when present on the underlying document.
Responses
Successful response
-
entity_idstring · max: 1000required -
entity_type -
Values:
hostuserservicegeneric -
entriesobjectrequired -
@timestampstring · max: 33required -
calculated_level -
Values:
UnknownLowModerateHighCritical -
calculated_scorenumber -
calculated_score_normnumber · min: 0 · max: 100required -
category_1_countinteger -
category_1_scorenumber -
category_2_countinteger -
category_2_scorenumber -
criticality_level -
The criticality level of the asset.
-
Values:
low_impactmedium_impacthigh_impactextreme_impact -
inputsobject -
Present only when requested with
include_contributions=true. -
categorystringrequired -
The risk category of the risk input document.
-
contribution_scorenumber -
descriptionstringrequired -
A human-readable description of the risk input document.
-
entity_idstring -
The EUID of the entity within the graph that generated this alert.
-
idstringrequired -
The unique identifier (
_id) of the original source document -
indexstringrequired -
The unique index (
_index) of the original source document -
risk_scorenumber · min: 0 · max: 100 -
The weighted risk score of the risk input document.
-
timestampstring -
The @timestamp of the risk input document.
-
modifiersobject -
Present only when requested with
include_contributions=true. -
contributionnumberrequired -
metadataobject -
modifier_valuenumber -
subtypestring · max: 100 -
typestring · max: 100required -
score_type -
Values:
basepropagatedresolution -
intervalstring · max: 10required -
The effective Elasticsearch
date_histograminterval expression the entries were aggregated into (for example3h,1d,1w), derived from the requested time range.
Invalid request