Install the Entity Store

Base URL
https://{kibana_url}
  • POST /api/security/entity_store/install
Auth

Install the Entity Store and create engines for the specified entity types. A single logExtraction configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the default value. To change settings after install, use the update endpoint.

Required authorization

Privileges securitySolution

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

entityTypes enum[] · default: [ "user", "host", "service", "generic" ]
Values: user host service generic
historySnapshot object
frequency string · max length: 32 · pattern: [smdh]$ · default: 24h
logExtraction object
additionalIndexPatterns string[] · max items: 1000 nullable
delay string · max length: 32 · pattern: [smdh]$ nullable
docsLimit integer · min: 1 · max: 9007199254740991 nullable
excludedIndexPatterns string[] · max items: 1000 nullable
fieldHistoryLength integer · min: -9007199254740991 · max: 9007199254740991 nullable
frequency string · max length: 32 · pattern: [smdh]$ nullable
lookbackPeriod string · max length: 32 · pattern: [smdh]$ nullable
maxLogsPerPage integer · min: 1 · max: 9007199254740991 nullable
maxLogsPerWindow integer · min: 0 · max: 9007199254740991 nullable
maxLogsPerWindowCapBehavior enum nullable
Values: defer drop
maxTimeWindowSize string · max length: 32 · pattern: [smdh]$ nullable

Responses

200

Indicates all requested entity types are already installed.

application/json
201

Indicates the Entity Store was successfully installed.

application/json
403

Insufficient privileges.

application/json
Base URL
https://{kibana_url}