Update the Entity Store

Base URL: https://{kibana_url}

PUT /api/security/entity_store
PUT /s/{space_id}/api/security/entity_store

Refer to Spaces for more information.

Update the Entity Store configuration without reinstalling. Send logExtraction to change log extraction settings. Omitting a log extraction field leaves it unchanged. Sending null for a log extraction field clears that override and reverts to the entity type default (for frequency: 1m for host and user, 10m for service, 30m for generic). Send historySnapshot.frequency to change the snapshot interval (at least 1 hour) and historySnapshot.retentionDays to change how long snapshots are kept. Omitting either history snapshot field leaves it unchanged. At least one of logExtraction, excludedUserNames or historySnapshot is required.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

application/json

400

Bad request.

application/json

404

Entity Store not found.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 4 languages

Console Kibana Dev Tools

PUT kbn://api/security/entity_store
{
  "logExtraction": {
    "lookbackPeriod": "6h",
    "frequency": "10m",
    "fieldHistoryLength": 15
  }
}

Console Kibana Dev Tools

PUT kbn://api/security/entity_store
{
  "historySnapshot": {
    "frequency": "12h",
    "retentionDays": 90
  }
}

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"logExtraction":{"lookbackPeriod":"6h","frequency":"10m","fieldHistoryLength":15}}' \
  "${KIBANA_URL}/api/security/entity_store"

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"historySnapshot":{"frequency":"12h","retentionDays":90}}' \
  "${KIBANA_URL}/api/security/entity_store"

Response

A log extraction parameter has an invalid duration format.

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Request Console 1 / 2 languages

Send null for any field to clear that override and revert it to the entity type default. For frequency, that is 1m for host and user, 10m for service and 30m for generic.

Console Kibana Dev Tools

PUT kbn:/api/security/entity_store
{
  "logExtraction": {
    "delay": "null",
    "frequency": "null"
  }
}

Generated from the API spec

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "logExtraction": {
      "delay": "null",
      "frequency": "null"
    }
  }' \
  "${KIBANA_URL}/api/security/entity_store"

Generated from the API spec

Response

The Entity Store configuration was successfully updated.

{
  "ok": true
}

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Request Console 1 / 2 languages

Update the history snapshot interval and retention. Omit a field to leave it unchanged.

Console Kibana Dev Tools

PUT kbn:/api/security/entity_store
{
  "historySnapshot": {
    "frequency": "12h",
    "retentionDays": 90
  }
}

Generated from the API spec

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "historySnapshot": {
      "frequency": "12h",
      "retentionDays": 90
    }
  }' \
  "${KIBANA_URL}/api/security/entity_store"

Generated from the API spec

Response

The Entity Store configuration was successfully updated.

{
  "ok": true
}

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Request Console 1 / 2 languages

Update the log extraction configuration with a new lookback period and frequency.

Console Kibana Dev Tools

PUT kbn:/api/security/entity_store
{
  "logExtraction": {
    "fieldHistoryLength": 15,
    "frequency": "10m",
    "lookbackPeriod": "6h"
  }
}

Generated from the API spec

curl Shell

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "logExtraction": {
      "fieldHistoryLength": 15,
      "frequency": "10m",
      "lookbackPeriod": "6h"
    }
  }' \
  "${KIBANA_URL}/api/security/entity_store"

Generated from the API spec

Response

The Entity Store configuration was successfully updated.

{
  "ok": true
}

{
  "error": "Bad Request",
  "message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entity store is not installed",
  "statusCode": 404
}

Update the Entity Store

Required authorization

Authentication

Header parameters

Request body

Responses

Required authorization

Authentication

Header parameters

Request body { }

Responses

Request body