Get risk score history for an entity

Base URL
https://{kibana_url}
  • GET /api/risk_score/history
Auth

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.

Query parameters

entity_type enum required

The type of entity to retrieve history for.

Values: host user service generic
entity_id string · max length: 1000 required

The identifier of the entity to retrieve history for.

from string · max length: 100 · default: now-90d

Start of the time range, in date-math syntax. Defaults to 90 days ago.

to string · max length: 100 · default: now

End of the time range, in date-math syntax. Defaults to now.

score_type enum

Filter entries by the type of score recorded (base, propagated, or resolution).

Values: base propagated resolution
include_contributions boolean · default: false

When true, each entry also includes the contributions recorded for that scoring run (inputs, modifiers, category 2 fields, and criticality_level), when present on the underlying document.

Responses

Successful response

application/json
entity_id string · max length: 1000 required
entity_type enum required
Values: host user service generic
entries object[] required
@timestamp string · format: date-time · max length: 33 required
calculated_level enum required
Values: Unknown Low Moderate High Critical
calculated_score number · format: double
calculated_score_norm number · format: double · min: 0 · max: 100 required
category_1_count integer
category_1_score number · format: double
category_2_count integer
category_2_score number · format: double
criticality_level enum

The criticality level of the asset.

Values: low_impact medium_impact high_impact extreme_impact
inputs object[]

Present only when requested with include_contributions=true.

category string required

The risk category of the risk input document.

contribution_score number · format: double
description string required

A human-readable description of the risk input document.

entity_id string

The EUID of the entity within the graph that generated this alert.

id string required

The unique identifier (_id) of the original source document

index string required

The unique index (_index) of the original source document

risk_score number · format: double · min: 0 · max: 100

The weighted risk score of the risk input document.

timestamp string

The @timestamp of the risk input document.

modifiers object[]

Present only when requested with include_contributions=true.

contribution number · format: double required
metadata object
modifier_value number · format: double
subtype string · max length: 100
type string · max length: 100 required
score_type enum
Values: base propagated resolution
interval string · max length: 10 required

The effective Elasticsearch date_histogram interval expression the entries were aggregated into (for example 3h, 1d, 1w), derived from the requested time range.

400

Invalid request

Base URL
https://{kibana_url}