Upload a CSV file to add entities to a watchlist

Base URL: https://{kibana_url}

POST /api/entity_analytics/watchlists/{watchlist_id}/csv_upload

Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row with a "type" column (user, host, service, or generic) and one or more ECS identity fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.

Matched entities are added to the watchlist and their entity.attributes.watchlists field is updated in the entity store.

Each row will match up to 10,000 entities.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

413

File too large

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/entity_analytics/watchlists/high-risk-vendors/csv_upload
{
  "file": "type,user.name\nuser,john.doe\nuser,jane.smith\n"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/entity_analytics/watchlists/high-risk-vendors/csv_upload" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: multipart/form-data" \
  -d '{
    "file": "type,user.name\nuser,john.doe\nuser,jane.smith\n"
  }'

Generated from the API spec

Response

{
  "failed": 1,
  "items": [
    {
      "matchedEntities": 1,
      "status": "success"
    },
    {
      "error": "Invalid entity type",
      "matchedEntities": 0,
      "status": "failure"
    },
    {
      "matchedEntities": 0,
      "status": "unmatched"
    }
  ],
  "successful": 1,
  "total": 3,
  "unmatched": 1
}

Upload a CSV file to add entities to a watchlist

Authentication

Path parameters

Request body

Responses