---
type: api
title: Bulk update entities
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-put-security-entity-store-entities-bulk
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-put-security-entity-store-entities-bulk
products:
  - Kibana
---

# Bulk update entities

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/security/entity_store/entities/bulk`
- `PUT` `/s/{space_id}/api/security/entity_store/entities/bulk`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Update multiple entity records in the Entity Store in a single request.<br/><br/>[Required authorization] Route required privileges: securitySolution.

## Query String Parameters

- `force` (union enum | boolean · default: false)
  When true, allows updating protected fields.
  Values: `true`, `false`

## Request Body

`application/json`

- `entities` ([] object) — required
  The entities to update.
  - `doc` (union anyOf) — optional
    - **{ user }**
      - `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `asset` (object) — optional
        - `business_unit` (string) — optional
        - `criticality` (union anyOf) — optional
          Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
        - `environment` (string) — optional
        - `id` (string) — optional
        - `model` (string) — optional
        - `name` (string) — optional
        - `owner` (string) — optional
        - `serial_number` (string) — optional
        - `vendor` (string) — optional
      - `entity` (object) — optional
        - `attributes` (object) — optional
          - `asset` (boolean) — optional
          - `known_redirects` ([] string) — optional
          - `managed` (boolean) — optional
          - `mfa_enabled` (boolean) — optional
          - `oauth_consent_restriction` (string) — optional
          - `permissions` ([] string) — optional
          - `storage_class` (string) — optional
          - `watchlists` ([] string) — optional
        - `behaviors` (object) — optional
          - `anomaly_job_ids` ([] string) — optional
          - `rule_names` ([] string) — optional
        - `EngineMetadata` (object) — optional
          - `Type` (string) — optional
        - `id` (string) — optional
        - `lifecycle` (object) — optional
          - `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
        - `name` (string) — optional
        - `relationships` (object) — optional
          - `accesses_frequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `accesses_infrequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `administers` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `communicates_with` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `depends_on` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns_inferred` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `resolution` (object) — optional
            - `resolved_to` (string) — optional
            - `risk` (object) — optional
              - `calculated_level` (enum) — optional
                Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
              - `calculated_score` (number) — optional
              - `calculated_score_norm` (number · min: 0 · max: 100) — optional
          - `supervises` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `schema_version` (string) — optional
        - `source` ([] string) — optional
        - `sub_type` (string) — optional
        - `type` (string) — optional
        - `url` (string) — optional
      - `event` (object) — optional
        - `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `labels` (map string to object) — optional
      - `tags` ([] string) — optional
      - `user` (object) — optional
        - `domain` ([] string) — optional
        - `email` ([] string) — optional
        - `full_name` ([] string) — optional
        - `hash` ([] string) — optional
        - `id` ([] string) — optional
        - `name` (string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `roles` ([] string) — optional
    - **{ host }**
      - `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `asset` (object) — optional
        - `business_unit` (string) — optional
        - `criticality` (union anyOf) — optional
          Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
        - `environment` (string) — optional
        - `id` (string) — optional
        - `model` (string) — optional
        - `name` (string) — optional
        - `owner` (string) — optional
        - `serial_number` (string) — optional
        - `vendor` (string) — optional
      - `entity` (object) — optional
        - `attributes` (object) — optional
          - `asset` (boolean) — optional
          - `known_redirects` ([] string) — optional
          - `managed` (boolean) — optional
          - `mfa_enabled` (boolean) — optional
          - `oauth_consent_restriction` (string) — optional
          - `permissions` ([] string) — optional
          - `storage_class` (string) — optional
          - `watchlists` ([] string) — optional
        - `behaviors` (object) — optional
          - `anomaly_job_ids` ([] string) — optional
          - `rule_names` ([] string) — optional
        - `EngineMetadata` (object) — optional
          - `Type` (string) — optional
        - `id` (string) — optional
        - `lifecycle` (object) — optional
          - `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
        - `name` (string) — optional
        - `relationships` (object) — optional
          - `accesses_frequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `accesses_infrequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `administers` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `communicates_with` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `depends_on` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns_inferred` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `resolution` (object) — optional
            - `resolved_to` (string) — optional
            - `risk` (object) — optional
              - `calculated_level` (enum) — optional
                Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
              - `calculated_score` (number) — optional
              - `calculated_score_norm` (number · min: 0 · max: 100) — optional
          - `supervises` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `schema_version` (string) — optional
        - `source` ([] string) — optional
        - `sub_type` (string) — optional
        - `type` (string) — optional
        - `url` (string) — optional
      - `event` (object) — optional
        - `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `host` (object) — optional
        - `architecture` ([] string) — optional
        - `domain` ([] string) — optional
        - `hostname` ([] string) — optional
        - `id` ([] string) — optional
        - `ip` ([] string) — optional
        - `mac` ([] string) — optional
        - `name` (string) — optional
        - `os` (object) — optional
          - `family` (string) — optional
          - `full` (string) — optional
          - `kernel` (string) — optional
          - `name` (union string | [] string) — optional
          - `platform` (string) — optional
          - `type` (union string | [] string) — optional
          - `version` (string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `type` ([] string) — optional
      - `labels` (map string to object) — optional
      - `tags` ([] string) — optional
    - **{ service }**
      - `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `asset` (object) — optional
        - `business_unit` (string) — optional
        - `criticality` (union anyOf) — optional
          Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
        - `environment` (string) — optional
        - `id` (string) — optional
        - `model` (string) — optional
        - `name` (string) — optional
        - `owner` (string) — optional
        - `serial_number` (string) — optional
        - `vendor` (string) — optional
      - `entity` (object) — optional
        - `attributes` (object) — optional
          - `asset` (boolean) — optional
          - `known_redirects` ([] string) — optional
          - `managed` (boolean) — optional
          - `mfa_enabled` (boolean) — optional
          - `oauth_consent_restriction` (string) — optional
          - `permissions` ([] string) — optional
          - `storage_class` (string) — optional
          - `watchlists` ([] string) — optional
        - `behaviors` (object) — optional
          - `anomaly_job_ids` ([] string) — optional
          - `rule_names` ([] string) — optional
        - `EngineMetadata` (object) — optional
          - `Type` (string) — optional
        - `id` (string) — optional
        - `lifecycle` (object) — optional
          - `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
        - `name` (string) — optional
        - `relationships` (object) — optional
          - `accesses_frequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `accesses_infrequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `administers` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `communicates_with` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `depends_on` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns_inferred` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `resolution` (object) — optional
            - `resolved_to` (string) — optional
            - `risk` (object) — optional
              - `calculated_level` (enum) — optional
                Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
              - `calculated_score` (number) — optional
              - `calculated_score_norm` (number · min: 0 · max: 100) — optional
          - `supervises` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `schema_version` (string) — optional
        - `source` ([] string) — optional
        - `sub_type` (string) — optional
        - `type` (string) — optional
        - `url` (string) — optional
      - `event` (object) — optional
        - `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `labels` (map string to object) — optional
      - `service` (object) — optional
        - `address` (string) — optional
        - `environment` (string) — optional
        - `ephemeral_id` (string) — optional
        - `id` (string) — optional
        - `name` (string) — optional
        - `node` (object) — optional
          - `name` (string) — optional
          - `role` (string) — optional
          - `roles` ([] string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `state` (string) — optional
        - `type` (string) — optional
        - `version` (string) — optional
      - `tags` ([] string) — optional
    - **{ cloud, orchestrator }**
      - `@timestamp` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `asset` (object) — optional
        - `business_unit` (string) — optional
        - `criticality` (union anyOf) — optional
          Values: `low_impact`, `medium_impact`, `high_impact`, `extreme_impact`
        - `environment` (string) — optional
        - `id` (string) — optional
        - `model` (string) — optional
        - `name` (string) — optional
        - `owner` (string) — optional
        - `serial_number` (string) — optional
        - `vendor` (string) — optional
      - `cloud` (object) — optional
        - `account` (object) — optional
          - `id` (string) — optional
          - `name` (string) — optional
        - `availability_zone` (string) — optional
        - `instance` (object) — optional
          - `id` (string) — optional
          - `name` (string) — optional
        - `machine` (object) — optional
          - `type` (string) — optional
        - `project` (object) — optional
          - `id` (string) — optional
          - `name` (string) — optional
        - `provider` (string) — optional
        - `region` (string) — optional
        - `service` (object) — optional
          - `name` (string) — optional
      - `entity` (object) — optional
        - `attributes` (object) — optional
          - `asset` (boolean) — optional
          - `known_redirects` ([] string) — optional
          - `managed` (boolean) — optional
          - `mfa_enabled` (boolean) — optional
          - `oauth_consent_restriction` (string) — optional
          - `permissions` ([] string) — optional
          - `storage_class` (string) — optional
          - `watchlists` ([] string) — optional
        - `behaviors` (object) — optional
          - `anomaly_job_ids` ([] string) — optional
          - `rule_names` ([] string) — optional
        - `EngineMetadata` (object) — optional
          - `Type` (string) — optional
        - `id` (string) — optional
        - `lifecycle` (object) — optional
          - `first_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_activity` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
          - `last_seen` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
        - `name` (string) — optional
        - `relationships` (object) — optional
          - `accesses_frequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `accesses_infrequently` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `administers` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `communicates_with` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `depends_on` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `owns_inferred` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
          - `resolution` (object) — optional
            - `resolved_to` (string) — optional
            - `risk` (object) — optional
              - `calculated_level` (enum) — optional
                Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
              - `calculated_score` (number) — optional
              - `calculated_score_norm` (number · min: 0 · max: 100) — optional
          - `supervises` (object) — optional
            - `ids` ([] string) — optional
            - `raw_identifiers` (object) — optional
              - `entity.id` ([] string) — optional
              - `host.id` ([] string) — optional
              - `host.name` ([] string) — optional
              - `service.name` ([] string) — optional
              - `user.email` ([] string) — optional
              - `user.id` ([] string) — optional
              - `user.name` ([] string) — optional
        - `risk` (object) — optional
          - `calculated_level` (enum) — optional
            Values: `Unknown`, `Low`, `Moderate`, `High`, `Critical`
          - `calculated_score` (number) — optional
          - `calculated_score_norm` (number · min: 0 · max: 100) — optional
        - `schema_version` (string) — optional
        - `source` ([] string) — optional
        - `sub_type` (string) — optional
        - `type` (string) — optional
        - `url` (string) — optional
      - `event` (object) — optional
        - `ingested` (string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$) — optional
      - `labels` (map string to object) — optional
      - `orchestrator` (object) — optional
        - `api_version` (string) — optional
        - `cluster` (object) — optional
          - `id` (string) — optional
          - `name` (string) — optional
          - `url` (string) — optional
          - `version` (string) — optional
        - `namespace` (string) — optional
        - `organization` (string) — optional
        - `resource` (object) — optional
          - `annotation` (string) — optional
          - `id` (string) — optional
          - `ip` (string) — optional
          - `label` (string) — optional
          - `name` (string) — optional
          - `parent` (object) — optional
            - `type` (string) — optional
          - `type` (string) — optional
        - `type` (string) — optional
      - `tags` ([] string) — optional
  - `type` (enum) — required
    The entity type of this record.
    Values: `user`, `host`, `service`, `generic`

## Responses

#### `200`

Indicates a successful response.

#### `400`

Bad request.

## Code Examples

#### Console

```console
PUT kbn://api/security/entity_store/entities/bulk?force=true
{
  "entities": [
    {
      "type": "host",
      "doc": {
        "entity": {
          "id": "host:web-server-prod-01",
          "name": "web-server-prod-01",
          "type": "host",
          "attributes": { "asset": true }
        },
        "host": { "name": "web-server-prod-01" }
      }
    }
  ]
}
```

#### curl

```curl
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entities":[{"type":"host","doc":{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","attributes":{"asset":true}},"host":{"name":"web-server-prod-01"}}}]}' \
  "${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true"
```

## Response Examples

#### Partial success with errors

Some entities were updated but others encountered Elasticsearch-level errors.

```json
{
  "errors": [
    {
      "_id": "5de9f93a68a72532e736bf5a6184b06300b9cabf",
      "reason": "[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing",
      "status": 404,
      "type": "document_missing_exception"
    }
  ],
  "ok": true
}
```

#### All entities updated

All entities were successfully updated with no errors.

```json
{
  "errors": [],
  "ok": true
}
```

#### Protected fields without force

The request attempts to update protected fields without the force query parameter.

```json
{
  "error": "Bad Request",
  "message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
  "statusCode": 400
}
```