Install the Entity Store

Server: https://{kibana_url}

POST /api/security/entity_store/install
POST /s/{space_id}/api/security/entity_store/install

Refer to Spaces for more information.

Install the Entity Store and create engines for the specified entity types. A single logExtraction configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. To change settings after install, use the update endpoint.

[Required authorization] Route required privileges: securitySolution.

Request

Responses

200

Indicates all requested entity types are already installed.

application/json

201

Indicates the Entity Store was successfully installed.

application/json

403

Insufficient privileges.

application/json

Examples

Install the Entity Store for all entity types with default log extraction settings.

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn://api/security/entity_store/install
{
  "entityTypes": ["user", "host", "service", "generic"],
  "logExtraction": {}
}

curl Shell

curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entityTypes":["user","host","service","generic"],"logExtraction":{}}' \
  "${KIBANA_URL}/api/security/entity_store/install"

Response

{
  "ok": true
}

{
  "ok": true
}

{
  "error": "Forbidden",
  "message": "User \u0027analyst\u0027 has insufficient privileges",
  "statusCode": 403
}

Install the Entity Store for host entities only with a custom lookback period and field history length.

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/security/entity_store/install
{
  "entityTypes": [
    "host"
  ],
  "logExtraction": {
    "delay": "2m",
    "fieldHistoryLength": 20,
    "frequency": "5m",
    "lookbackPeriod": "12h"
  }
}

curl Shell

curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
  "entityTypes": [
    "host"
  ],
  "logExtraction": {
    "delay": "2m",
    "fieldHistoryLength": 20,
    "frequency": "5m",
    "lookbackPeriod": "12h"
  }
}' \
  "${KIBANA_URL}/api/security/entity_store/install"

Response

{
  "ok": true
}

{
  "ok": true
}

{
  "error": "Forbidden",
  "message": "User \u0027analyst\u0027 has insufficient privileges",
  "statusCode": 403
}

Request { entityTypes , historySnapshot , logExtraction , }

Responses

Request