Configure the Risk Engine Saved Object

Base URL: https://{kibana_url}

PATCH /api/risk_score/engine/saved_object/configure

Auth

Configuring the Risk Engine Saved Object

Request body

enable_reset_to_zero boolean
exclude_alert_statuses string[]
exclude_alert_tags string[]
filters object[]
page_size integer · min: 100 · max: 10000: Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES|QL result limit (10,000 by default).
range object

Responses

Successful response

application/json

risk_engine_saved_object_configured boolean

Task manager is unavailable

application/json

message string required
status_code integer · min: 400 required

Unexpected error

application/json

errors object[] required
risk_engine_saved_object_configured boolean required

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PATCH kbn:/api/risk_score/engine/saved_object/configure
{
  "enable_reset_to_zero": false,
  "exclude_alert_statuses": [
    "closed"
  ],
  "exclude_alert_tags": [
    "low-priority"
  ],
  "filters": [
    {
      "entity_types": [
        "host",
        "user"
      ],
      "filter": "host.name: *"
    }
  ],
  "range": {
    "end": "now",
    "start": "now-30d"
  }
}

Generated from the API spec

curl Shell

curl -X PATCH "${KIBANA_URL}/api/risk_score/engine/saved_object/configure" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "enable_reset_to_zero": false,
    "exclude_alert_statuses": [
      "closed"
    ],
    "exclude_alert_tags": [
      "low-priority"
    ],
    "filters": [
      {
        "entity_types": [
          "host",
          "user"
        ],
        "filter": "host.name: *"
      }
    ],
    "range": {
      "end": "now",
      "start": "now-30d"
    }
  }'

Generated from the API spec

Response

{
  "risk_engine_saved_object_configured": true
}

{
  "message": "Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.",
  "status_code": 400
}

{
  "errors": [
    {
      "error": "Internal server error",
      "seq": 1
    }
  ],
  "risk_engine_saved_object_configured": false
}

Request body { }

Responses

Request body