Cleanup the Risk Engine

Base URL: https://{kibana_url}

DELETE /api/risk_score/engine/dangerously_delete_data
DELETE /s/{space_id}/api/risk_score/engine/dangerously_delete_data

Auth

Stops risk scoring for the space. Removes the risk score data stream, the lookup index and its template, the risk engine configuration, and the risk score maintainer task, and clears risk fields stored on entity documents.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Responses

Successful response

application/json

cleanup_successful boolean

Task manager is unavailable

application/json

Unexpected error

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

DELETE kbn:/api/risk_score/engine/dangerously_delete_data

Generated from the API spec

curl Shell

curl -X DELETE "${KIBANA_URL}/api/risk_score/engine/dangerously_delete_data" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "cleanup_successful": true
}

{
  "message": "Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.",
  "status_code": 400
}

{
  "cleanup_successful": false,
  "errors": [
    {
      "error": "Risk engine is disabled or deleted already.",
      "seq": 1
    }
  ]
}