Get resolution group

Base URL: https://{kibana_url}

GET /api/security/entity_store/resolution/group
GET /s/{space_id}/api/security/entity_store/resolution/group

Auth

Get the resolution group for a given entity, returning all linked entities.

Required authorization

Privileges securitySolution and securitySolution-entity-analytics

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

entity_id string required: The entity identifier to look up the resolution group for.

Responses

200

Indicates a successful response.

application/json

400

Bad request.

application/json

404

Entity not found.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn://api/security/entity_store/resolution/group?entity_id=user:jane.doe@example.com

curl Shell

curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
  "${KIBANA_URL}/api/security/entity_store/resolution/group?entity_id=user%3Ajane.doe%40example.com"

Response

Returns the resolution group for an entity, including the target entity, all aliases, and the group size.

{
  "aliases": [
    {
      "@timestamp": "2026-04-10T08:25:00.000Z",
      "entity": {
        "id": "user:jdoe@example.com",
        "name": "jdoe",
        "relationships": {
          "resolution": {
            "resolved_to": "user:jane.doe@example.com"
          }
        },
        "type": "user"
      },
      "user": {
        "name": "jdoe"
      }
    }
  ],
  "entity_type": "user",
  "group_size": 2,
  "target": {
    "@timestamp": "2026-04-10T08:30:00.000Z",
    "entity": {
      "id": "user:jane.doe@example.com",
      "name": "jane.doe",
      "type": "user"
    },
    "user": {
      "email": [
        "jane.doe@example.com"
      ],
      "name": "jane.doe"
    }
  }
}

{
  "error": "Bad Request",
  "message": "Resolution search truncated",
  "statusCode": 400
}

{
  "error": "Not Found",
  "message": "Entities not found: [user:nonexistent@example.com]",
  "statusCode": 404
}