Bulk update entities

Base URL
https://{kibana_url}
  • PUT /api/security/entity_store/entities/bulk
  • PUT /s/{space_id}/api/security/entity_store/entities/bulk
Auth

Update multiple entity records in the Entity Store in a single request.

Required authorization

Privileges securitySolution

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

force union enum | boolean · default: false

When true, allows updating protected fields.

Values: true false

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

entities object[] required

The entities to update.

doc union anyOf
Any of:
@timestamp string · format: date-time · max length: 64

The time the entity record was last updated.

asset object
business_unit string

Business unit the asset belongs to.

criticality enum nullable

The criticality level assigned to this asset.

Values: low_impact medium_impact high_impact extreme_impact
environment string

Deployment environment (for example, production, staging).

id string

Unique identifier for the asset.

model string

Model name or number.

name string

Human-readable asset name.

owner string

The owner of the asset.

serial_number string

Serial number of the asset.

vendor string

Vendor or manufacturer.

entity object
attributes object

Boolean flags describing characteristics of the entity.

asset boolean

Whether the entity is classified as an asset.

known_redirects string[]

Known redirect URIs or URLs (e.g. OAuth application callbacks).

managed boolean

Whether the entity is managed (for example, via a directory service).

mfa_enabled boolean

Whether multi-factor authentication is enabled for the entity.

OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).

permissions string[]

Action-level permissions granted to this entity (not roles or groups).

storage_class string

Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).

watchlists string[]

Watchlist identifiers the entity belongs to (v2).

behaviors object

Behavioral signals observed for the entity.

anomaly_job_ids string[]

Machine learning anomaly job identifiers (v2).

rule_names string[]

Detection rule names that flagged this entity (v2).

created_by string

Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).

EngineMetadata object
Type string

The engine type that produced this entity record.

id string

Unique identifier for this entity.

lifecycle object

Timestamps tracking the entity lifecycle.

first_seen string · format: date-time · max length: 64

When the entity was first observed.

last_activity string · format: date-time · max length: 64

When the entity last generated activity.

last_seen string · format: date-time · max length: 64

When the entity was last observed.

name string

Human-readable name of the entity.

relationships object

Connections between this entity and other entities.

accesses_frequently object

Entities this entity accesses frequently.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
accesses_infrequently object

Entities this entity accesses infrequently.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
administers object

Entities this entity administers (for example, a user who is an admin of a service).

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
communicates_with object

Entities this entity communicates with.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
depends_on object

Entities this entity depends on.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
owns object

Entities owned by this entity.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
owns_inferred object

Entities inferred to be owned by this entity.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
resolution object

Resolution metadata linking this entity to another.

resolved_to string

entity.id of the entity this one resolves to

risk object

Aggregated risk score for the resolution group.

calculated_level enum

Lexical description of the resolution group's aggregated risk.

Values: Unknown Low Moderate High Critical
calculated_score number

The raw numeric value of the resolution group's aggregated risk score.

calculated_score_norm number · min: 0 · max: 100

The normalized numeric value of the resolution group's aggregated risk score.

supervises object

Entities supervised by this entity.

ids string[]

Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.

raw_identifiers object
entity.id string[]
host.id string[]
host.name string[]
service.name string[]
user.email string[]
user.id string[]
user.name string[]
risk object

Risk scoring information for the entity.

calculated_level enum

Lexical description of the entity's risk.

Values: Unknown Low Moderate High Critical
calculated_score number

The raw numeric value of the given entity's risk score.

calculated_score_norm number · min: 0 · max: 100

The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.

schema_version string

Schema version of the entity record.

source string[]

Sources that produced this entity record.

sub_type string

Optional sub-type classification for the entity.

type string

The entity type.

url string

URL associated with the entity.

event object
ingested string · format: date-time · max length: 64

When the event was ingested into Elasticsearch.

labels map string to object

Custom key-value labels attached to the entity.

tags string[]

Tags attached to the entity.

user object

Elastic Common Schema (ECS) user fields collected on the entity.

domain string[]

Observed user domains.

email string[]

Observed email addresses.

full_name string[]

Observed full names of the user.

hash string[]

Observed user hashes.

id string[]

Observed user identifiers.

name string

Primary user name.

risk object
calculated_level enum

Lexical description of the entity's risk.

Values: Unknown Low Moderate High Critical
calculated_score number

The raw numeric value of the given entity's risk score.

calculated_score_norm number · min: 0 · max: 100

The normalized numeric value of the given entity's risk score.

roles string[]

Observed roles assigned to the user.

type enum required

The entity type of this record.

Values: user host service generic

Responses

200

Indicates a successful response.

application/json
400

Bad request.

application/json
Base URL
https://{kibana_url}