Update a monitored user

Base URL
https://{kibana_url}
  • PUT /api/entity_analytics/monitoring/users/{id}
  • PUT /s/{space_id}/api/entity_analytics/monitoring/users/{id}
Auth Deprecated

Deprecated in 9.4.0. Use the Watchlists API instead.

Updates the details of an existing monitored privileged user by their document ID.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The document ID of the monitored user to update

Request body

entity_analytics_monitoring object
labels object[]
field string · max length: 256 required
source string required
value string · max length: 256 required
id string · max length: 256
labels object
source_ids string[] · max items: 100
source_integrations string[] · max items: 100
sources enum[] · max items: 100
Values: csv index_sync api
user object
is_privileged boolean

Indicates if the user is privileged.

name string · max length: 512

Response

User updated successfully

application/json
entity_analytics_monitoring object
labels object[]
field string · max length: 256 required
source string required
value string · max length: 256 required
id string · max length: 256
labels object
source_ids string[] · max items: 100
source_integrations string[] · max items: 100
sources enum[] · max items: 100
Values: csv index_sync api
user object
is_privileged boolean

Indicates if the user is privileged.

name string · max length: 512
@timestamp string · format: date-time
event object
@timestamp string · format: date-time
ingested string · format: date-time
Base URL
https://{kibana_url}