List all monitored users

Base URL
https://{kibana_url}
  • GET /api/entity_analytics/monitoring/users/list
Auth Deprecated

Deprecated in 9.4.0. Use the Watchlists API instead.

Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.

Query parameters

kql string

KQL query to filter the list of monitored users

Response

List of monitored users

application/json
<array> object[]
entity_analytics_monitoring object
labels object[]
field string · max length: 256 required
source string required
value string · max length: 256 required
id string · max length: 256
labels object
source_ids string[] · max items: 100
source_integrations string[] · max items: 100
sources enum[] · max items: 100
Values: csv index_sync api
user object
is_privileged boolean

Indicates if the user is privileged.

name string · max length: 512
@timestamp string · format: date-time
event object
@timestamp string · format: date-time
ingested string · format: date-time
Base URL
https://{kibana_url}