Configure the Risk Engine Saved Object

Base URL: https://{kibana_url}

PATCH /api/risk_score/engine/saved_object/configure

Configuring the Risk Engine Saved Object

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Responses

Successful response

application/json

Task manager is unavailable

application/json

Unexpected error

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PATCH kbn:/api/risk_score/engine/saved_object/configure
{
  "enable_reset_to_zero": false,
  "exclude_alert_statuses": [
    "closed"
  ],
  "exclude_alert_tags": [
    "low-priority"
  ],
  "filters": [
    {
      "entity_types": [
        "host",
        "user"
      ],
      "filter": "host.name: *"
    }
  ],
  "range": {
    "end": "now",
    "start": "now-30d"
  }
}

Generated from the API spec

curl Shell

curl -X PATCH "${KIBANA_URL}/api/risk_score/engine/saved_object/configure" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "enable_reset_to_zero": false,
    "exclude_alert_statuses": [
      "closed"
    ],
    "exclude_alert_tags": [
      "low-priority"
    ],
    "filters": [
      {
        "entity_types": [
          "host",
          "user"
        ],
        "filter": "host.name: *"
      }
    ],
    "range": {
      "end": "now",
      "start": "now-30d"
    }
  }'

Generated from the API spec

Response

{
  "risk_engine_saved_object_configured": true
}

{
  "message": "Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.",
  "status_code": 400
}

{
  "errors": [
    {
      "error": "Internal server error",
      "seq": 1
    }
  ],
  "risk_engine_saved_object_configured": false
}

Authentication

Request body { }

Responses

Request body