Upload a CSV file to add entities to a watchlist

Base URL
https://{kibana_url}
Auth

Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row with a "type" column (user, host, service, or generic) and one or more ECS identity fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.

Matched entities are added to the watchlist and their entity.attributes.watchlists field is updated in the entity store.

Each row will match up to 10,000 entities.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

watchlist_id string required

The ID of the watchlist to add entities to

Example: high-risk-vendors

Request body

file string · format: binary required

The CSV file to upload.

Responses

Upload successful

application/json
failed integer required

Number of rows that failed to process

items object[] required
error string

Error message if the row failed to process

matchedEntities integer required

Number of entities matched for this row

status enum required
Values: success failure unmatched
successful integer required

Number of rows that matched at least one entity

total integer required

Total number of rows processed

unmatched integer required

Number of rows that matched no entities

413

File too large

Base URL
https://{kibana_url}