Security entity analytics

Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.

29 endpoints

Delete an asset criticality record
- DELETE /api/asset_criticality
Get an asset criticality record
- GET /api/asset_criticality
Upsert an asset criticality record
- POST /api/asset_criticality
Bulk upsert asset criticality records
- POST /api/asset_criticality/bulk
List asset criticality records
- GET /api/asset_criticality/list
Delete the Privilege Monitoring Engine
- DELETE /api/entity_analytics/monitoring/engine/delete
Disable the Privilege Monitoring Engine
- POST /api/entity_analytics/monitoring/engine/disable
Initialize the Privilege Monitoring Engine
- POST /api/entity_analytics/monitoring/engine/init
Schedule the Privilege Monitoring Engine
- POST /api/entity_analytics/monitoring/engine/schedule_now
Health check on Privilege Monitoring
- GET /api/entity_analytics/monitoring/privileges/health
Run a privileges check on Privilege Monitoring
- GET /api/entity_analytics/monitoring/privileges/privileges
Create a new monitored user
- POST /api/entity_analytics/monitoring/users
Upsert multiple monitored users via CSV upload
- POST /api/entity_analytics/monitoring/users/_csv
Delete a monitored user
- DELETE /api/entity_analytics/monitoring/users/{id}
Update a monitored user
- PUT /api/entity_analytics/monitoring/users/{id}
List all monitored users
- GET /api/entity_analytics/monitoring/users/list
Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
- POST /api/entity_analytics/privileged_user_monitoring/pad/install
Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
- GET /api/entity_analytics/privileged_user_monitoring/pad/status
Create a new watchlist
- POST /api/entity_analytics/watchlists
Get a watchlist by ID
- GET /api/entity_analytics/watchlists/{id}
Update an existing watchlist
- PUT /api/entity_analytics/watchlists/{id}
Upload a CSV file to add entities to a watchlist
- POST /api/entity_analytics/watchlists/{watchlist_id}/csv_upload
Manually assign entities to a watchlist
- POST /api/entity_analytics/watchlists/{watchlist_id}/entities/assign
Manually unassign entities from a watchlist
- POST /api/entity_analytics/watchlists/{watchlist_id}/entities/unassign
List all watchlists
- GET /api/entity_analytics/watchlists/list
Cleanup the Risk Engine
- DELETE /api/risk_score/engine/dangerously_delete_data
Configure the Risk Engine Saved Object
- PATCH /api/risk_score/engine/saved_object/configure
Run the risk scoring engine
- POST /api/risk_score/engine/schedule_now
Get risk score history for an entity
- GET /api/risk_score/history