Unlink entities

Server: https://{kibana_url}

POST /api/security/entity_store/resolution/unlink
POST /s/{space_id}/api/security/entity_store/resolution/unlink

Refer to Spaces for more information.

Remove one or more entities from their resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).

[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.

Request

entity_ids [] string · min: 1 · max: 1000 required: Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000.

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn://api/security/entity_store/resolution/unlink
{
  "entity_ids": ["user:jdoe@example.com"]
}

curl Shell

curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entity_ids":["user:jdoe@example.com"]}' \
  "${KIBANA_URL}/api/security/entity_store/resolution/unlink"

Response

{
  "error": "Bad Request",
  "message": "All entities must be of the same type. Found types: [user, host]",
  "statusCode": 400
}

Remove entities from their resolution group, restoring them as standalone entities.

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/security/entity_store/resolution/unlink
{
  "entity_ids": [
    "user:jdoe@example.com",
    "user:j.doe@example.com"
  ]
}

curl Shell

curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
  "entity_ids": [
    "user:jdoe@example.com",
    "user:j.doe@example.com"
  ]
}' \
  "${KIBANA_URL}/api/security/entity_store/resolution/unlink"

Response

{
  "entity_type": "user",
  "skipped": [],
  "unlinked": [
    "user:jdoe@example.com",
    "user:j.doe@example.com"
  ]
}

{
  "error": "Bad Request",
  "message": "All entities must be of the same type. Found types: [user, host]",
  "statusCode": 400
}