Create a new monitored user

Base URL
https://{kibana_url}
  • POST /api/entity_analytics/monitoring/users
Auth Deprecated

Deprecated in 9.4.0. Use the Watchlists API instead.

Creates a new privileged user to be monitored by the Privilege Monitoring Engine.

Request body

entity_analytics_monitoring object

Entity analytics monitoring configuration for the user

labels object[] · max items: 100

Array of labels associated with the user

field string · max length: 256

The field name for the label

source enum

The source where this label was created (api, csv, or index_sync)

Values: api csv index_sync
value string · max length: 256

The value of the label

user object
name string · max length: 512

The name of the user.

Response

User created successfully

application/json
entity_analytics_monitoring object
labels object[]
field string · max length: 256 required
source string required
value string · max length: 256 required
id string · max length: 256
labels object
source_ids string[] · max items: 100
source_integrations string[] · max items: 100
sources enum[] · max items: 100
Values: csv index_sync api
user object
is_privileged boolean

Indicates if the user is privileged.

name string · max length: 512
@timestamp string · format: date-time
event object
@timestamp string · format: date-time
ingested string · format: date-time
Base URL
https://{kibana_url}