Security entity analytics
Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.
18 endpoints
-
Delete an asset criticality record
- DELETE /api/asset_criticality
-
Get an asset criticality record
- GET /api/asset_criticality
-
Upsert an asset criticality record
- POST /api/asset_criticality
-
Bulk upsert asset criticality records
- POST /api/asset_criticality/bulk
-
List asset criticality records
- GET /api/asset_criticality/list
-
Initialize the Entity Store
- POST /api/entity_store/enable
-
List the Entity Engines
- GET /api/entity_store/engines
-
Delete the Entity Engine
- DELETE /api/entity_store/engines/{entityType}
-
Get an Entity Engine
- GET /api/entity_store/engines/{entityType}
-
Initialize an Entity Engine
- POST /api/entity_store/engines/{entityType}/init
-
Start an Entity Engine
- POST /api/entity_store/engines/{entityType}/start
-
Stop an Entity Engine
- POST /api/entity_store/engines/{entityType}/stop
-
Apply DataView indices to all installed engines
- POST /api/entity_store/engines/apply_dataview_indices
-
List Entity Store Entities
- GET /api/entity_store/entities/list
-
Get the status of the Entity Store
- GET /api/entity_store/status
-
Cleanup the Risk Engine
- DELETE /api/risk_score/engine/dangerously_delete_data
-
Configure the Risk Engine Saved Object
- PATCH /api/risk_score/engine/saved_object/configure
-
Run the risk scoring engine
- POST /api/risk_score/engine/schedule_now