List entity resolution rules

Base URL: https://{kibana_url}

GET /api/security/entity_store/resolution/rules

Auth

List managed entity resolution rules and their effective enabled state for this space. Each rule description states what it bridges, which data sources it needs, and when to disable it.

Required authorization

Privileges securitySolution and securitySolution-entity-analytics

Response

200

Entity resolution rules.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/security/entity_store/resolution/rules

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/security/entity_store/resolution/rules" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

Lists the managed resolution rules and their enabled state in the current space.

{
  "rules": [
    {
      "description": "Links user entities that share the same email address, compared case-insensitively, across identity providers. Disable if shared mailboxes or role accounts produce false links.",
      "enabled": true,
      "id": "email_exact_match",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Windows and system account-management (IAM) entities to Active Directory by SID (\u0060user.id\u0060), excluding well-known SIDs such as LocalSystem. Needs Windows/system IAM events and Active Directory entity analytics. Disable if well-known SID exclusions are not enough for your environment.",
      "enabled": true,
      "id": "windows_sid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Microsoft Defender (\u0060m365_defender\u0060) identities to Entra ID by GUID-shaped \u0060user.id\u0060. Needs Defender identity events and Entra entity analytics. Disable if Defender SID IAM events leak through the GUID gate.",
      "enabled": true,
      "id": "entra_guid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links CrowdStrike user entities to Active Directory by SID-prefixed \u0060user.id\u0060 (filters out Linux UIDs). Needs CrowdStrike FDR IAM events and Active Directory entity analytics. Disable if CrowdStrike SID coverage is noisy in your tenant.",
      "enabled": true,
      "id": "crowdstrike_sid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Microsoft 365 audit actors (\u0060user.id\u0060 UPN) to Entra users (\u0060user.name\u0060 UPN), compared case-insensitively. Needs o365 audit user-lifecycle events and Entra entity analytics. Covers admins who perform AAD user operations; disable if that population should stay separate.",
      "enabled": true,
      "id": "upn_cross_field_bridge",
      "kind": "cross_field",
      "managed": true
    },
    {
      "description": "Related user alias resolution across identity providers",
      "enabled": false,
      "id": "related_user_alias_resolution",
      "kind": "related_user_alias_resolution",
      "managed": true
    }
  ]
}