Update the Entity Store

Base URL
https://{kibana_url}
  • PUT /api/security/entity_store
Auth

Update the Entity Store log extraction configuration. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the default value.

Required authorization

Privileges securitySolution

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

logExtraction object required
additionalIndexPatterns string[] · max items: 1000 nullable
delay string · max length: 32 · pattern: [smdh]$ nullable
docsLimit integer · min: 1 · max: 9007199254740991 nullable
excludedIndexPatterns string[] · max items: 1000 nullable
fieldHistoryLength integer · min: -9007199254740991 · max: 9007199254740991 nullable
frequency string · max length: 32 · pattern: [smdh]$ nullable
lookbackPeriod string · max length: 32 · pattern: [smdh]$ nullable
maxLogsPerPage integer · min: 1 · max: 9007199254740991 nullable
maxLogsPerWindow integer · min: 0 · max: 9007199254740991 nullable
maxLogsPerWindowCapBehavior enum nullable
Values: defer drop
maxTimeWindowSize string · max length: 32 · pattern: [smdh]$ nullable

Responses

200

Indicates a successful response.

application/json
400

Bad request.

application/json
404

Entity Store not found.

application/json
Base URL
https://{kibana_url}