Install the Entity Store

Base URL
https://{kibana_url}
  • POST /api/security/entity_store/install
  • POST /s/{space_id}/api/security/entity_store/install

Refer to Spaces for more information.

Install the Entity Store and create engines for the specified entity types. logExtraction sets overrides that apply to all entity types, on top of built-in defaults per entity type. The default frequency is 1m for host and user, 10m for service and 30m for generic. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the entity type default. To change settings after install, use the update endpoint.

Responses

200

Indicates all requested entity types are already installed.

application/json
201

Indicates the Entity Store was successfully installed.

application/json
403

Insufficient privileges.

application/json
Base URL
https://{kibana_url}