Kibana Security Entity Analytics API API
Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.
Kibana Security Entity Analytics API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Security Entity Analytics API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.
This API exposes 42 operations across 35 paths, and defines 59 schemas. It is described by OpenAPI 3.0.3.
Requests are made against a single base URL, https://{kibana_url}.
42 operations
35 paths
59 schemas
7 DELETE12 GET1 PATCH18 POST4 PUT
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 2
Kibana Security Entity Analytics API API declares
2 security schemes
for authenticating requests.
An API key is passed in the header as Authorization (apiKeyAuth).
It accepts HTTP basic authentication (basicAuth).
By default, every request must be authenticated.
apiKeyAuth— These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…
Paths & Operations 42
Across 35 paths, the API surfaces 42 operations — 7 DELETE, 12 GET, 1 PATCH, 18 POST, 4 PUT. Each is listed below with its method, path, parameters, and response codes.
Security Entity Analytics API 42
Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.
DELETE
/api/asset_criticality
Delete an asset criticality record
GET
/api/asset_criticality
Get an asset criticality record
POST
/api/asset_criticality
Upsert an asset criticality record
POST
/api/asset_criticality/bulk
Bulk upsert asset criticality records
GET
/api/asset_criticality/list
List asset criticality records
DELETE
/api/entity_analytics/monitoring/engine/delete
Delete the Privilege Monitoring Engine
POST
/api/entity_analytics/monitoring/engine/disable
Disable the Privilege Monitoring Engine
POST
/api/entity_analytics/monitoring/engine/init
Initialize the Privilege Monitoring Engine
POST
/api/entity_analytics/monitoring/engine/schedule_now
Schedule the Privilege Monitoring Engine
GET
/api/entity_analytics/monitoring/privileges/health
Health check on Privilege Monitoring
GET
/api/entity_analytics/monitoring/privileges/privileges
Run a privileges check on Privilege Monitoring
POST
/api/entity_analytics/monitoring/users
Create a new monitored user
POST
/api/entity_analytics/monitoring/users/_csv
Upsert multiple monitored users via CSV upload
DELETE
/api/entity_analytics/monitoring/users/{id}
Delete a monitored user
PUT
/api/entity_analytics/monitoring/users/{id}
Update a monitored user
GET
/api/entity_analytics/monitoring/users/list
List all monitored users
POST
/api/entity_analytics/privileged_user_monitoring/pad/install
Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
GET
/api/entity_analytics/privileged_user_monitoring/pad/status
Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
POST
/api/entity_analytics/watchlists
Create a new watchlist
GET
/api/entity_analytics/watchlists/{id}
Get a watchlist by ID
PUT
/api/entity_analytics/watchlists/{id}
Update an existing watchlist
POST
/api/entity_analytics/watchlists/{watchlist_id}/csv_upload
Upload a CSV file to add entities to a watchlist
POST
/api/entity_analytics/watchlists/{watchlist_id}/entities/assign
Manually assign entities to a watchlist
POST
/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign
Manually unassign entities from a watchlist
GET
/api/entity_analytics/watchlists/list
List all watchlists
POST
/api/entity_store/enable
Initialize the Entity Store
DELETE
/api/entity_store/engines
Delete Entity Engines
GET
/api/entity_store/engines
List the Entity Engines
DELETE
/api/entity_store/engines/{entityType}
Delete the Entity Engine
GET
/api/entity_store/engines/{entityType}
Get an Entity Engine
POST
/api/entity_store/engines/{entityType}/init
Initialize an Entity Engine
POST
/api/entity_store/engines/{entityType}/start
Start an Entity Engine
POST
/api/entity_store/engines/{entityType}/stop
Stop an Entity Engine
POST
/api/entity_store/engines/apply_dataview_indices
Apply DataView indices to all installed engines
DELETE
/api/entity_store/entities/{entityType}
Delete an entity in Entity Store
PUT
/api/entity_store/entities/{entityType}
Upsert an entity in Entity Store
PUT
/api/entity_store/entities/bulk
Upsert many entities in Entity Store
GET
/api/entity_store/entities/list
List Entity Store Entities
GET
/api/entity_store/status
Get the status of the Entity Store
DELETE
/api/risk_score/engine/dangerously_delete_data
Cleanup the Risk Engine
PATCH
/api/risk_score/engine/saved_object/configure
Configure the Risk Engine Saved Object
POST
/api/risk_score/engine/schedule_now
Run the risk scoring engine
Schemas 59
The contract defines 59 schemas that model the data the API accepts and returns. The most detailed are Security_Entity_Analytics_API_EntityRiskScoreRecord (18 properties), Security_Entity_Analytics_API_TransformStatsMetadata (17 properties), Security_Entity_Analytics_API_EngineDescriptor (12 properties), Security_Entity_Analytics_API_EntityField (11 properties). Each schema is shown below with its type and property counts.
Security_Entity_Analytics_API_HostEntity
object
An entity record representing a host, stored in the Entity Store latest index.
5 properties
1 required
Security_Entity_Analytics_API_EntityContainer
object
A wrapper that pairs an entity type with the entity record to upsert.
2 properties
2 required
Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts
object
5 properties
1 required
Security_Entity_Analytics_API_CreateAssetCriticalityRecord
Security_Entity_Analytics_API_Interval
string
Interval in which enrich policy runs. For example, "1h" means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,
Security_Entity_Analytics_API_EntitiesContainer
object
A collection of entities to upsert in bulk.
1 property
1 required
Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse
object
2 properties
2 required
Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus
string
The status of the Privilege Monitoring Engine
Security_Entity_Analytics_API_WatchlistObject
object
9 properties
3 required
Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats
object
3 properties
3 required
Security_Entity_Analytics_API_TransformStatsMetadata
object
Statistics from the underlying Elasticsearch transform.
17 properties
15 required
Security_Entity_Analytics_API_EngineComponentResource
string
The type of Elasticsearch or Kibana resource backing an engine component.
Security_Entity_Analytics_API_InspectQuery
object
Debug information about the Elasticsearch query executed.
2 properties
2 required
Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse
object
2 properties
2 required
Security_Entity_Analytics_API_EngineDataviewUpdateResult
object
The result of applying data view index changes to a single engine.
2 properties
1 required
Security_Entity_Analytics_API_ServiceEntity
object
An entity record representing a service, stored in the Entity Store latest index.
5 properties
1 required
Security_Entity_Analytics_API_EntityType
string
The type of entity.
Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload
string
The criticality level of the asset for bulk upload. The value unassigned is used to indicate that the criticality level is not assigned and is only used for bu…
Security_Entity_Analytics_API_RiskEngineScheduleNowResponse
object
1 property
Security_Entity_Analytics_API_AssetCriticalityLevel
string
The criticality level of the asset.
Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem
object
3 properties
3 required
Security_Entity_Analytics_API_IdField
string
Security_Entity_Analytics_API_EngineDescriptor
object
Describes a single entity engine, including its configuration and current status.
12 properties
4 required
Security_Entity_Analytics_API_EngineComponentStatus
object
Status of an individual Elasticsearch or Kibana resource backing an engine.
6 properties
3 required
Security_Entity_Analytics_API_EntitySourceType
string
Security_Entity_Analytics_API_TaskManagerUnavailableResponse
object
Task manager is unavailable
2 properties
2 required
Security_Entity_Analytics_API_EntityField
object
Core entity fields shared across all entity types. The entity namespace is a root-level field in the Entity Store latest index.
11 properties
1 required
Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse
object
2 properties
2 required
Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem
object
2 properties
2 required
Security_Entity_Analytics_API_StoreStatus
string
The overall operational status of the Entity Store.
Security_Entity_Analytics_API_AssetCriticalityRecordIdParts
object
2 properties
2 required
Security_Entity_Analytics_API_UserEntity
object
An entity record representing a user, stored in the Entity Store latest index.
5 properties
1 required
Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem
object
3 properties
2 required
Security_Entity_Analytics_API_EngineStatus
string
The current operational status of an entity engine.
Security_Entity_Analytics_API_EntityRiskLevels
string
Security_Entity_Analytics_API_EngineMetadata
object
Internal metadata attached to an entity by the engine that produced it.
1 property
1 required
Security_Entity_Analytics_API_EntityAnalyticsPrivileges
object
4 properties
2 required
Security_Entity_Analytics_API_RiskScoreInput
object
A generic representation of a document contributing to a Risk Score.
8 properties
4 required
Security_Entity_Analytics_API_GenericEntity
object
A generic entity record. Maps only the entity and asset namespaces. Add additional field mappings here as needed.
3 properties
1 required
Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties
object
11 properties
Security_Entity_Analytics_API_MonitoringLabel
object
3 properties
3 required
Security_Entity_Analytics_API_Entity
An entity record from the Entity Store. The entity namespace is a root-level field in the latest index, unlike source logs where it is nested under host, user,…
Security_Entity_Analytics_API_AssetCriticalityRecord
Security_Entity_Analytics_API_Filter
object
1 property
Security_Entity_Analytics_API_Integrations
object
2 properties
Security_Entity_Analytics_API_DateRange
object
Defines the lookback period for filtering source data by timestamp.
2 properties
2 required
Security_Entity_Analytics_API_Asset
object
Asset metadata associated with the entity.
9 properties
Security_Entity_Analytics_API_MonitoringEntitySourceProperties
Security_Entity_Analytics_API_Matcher
object
2 properties
2 required
Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem
object
3 properties
2 required
Security_Entity_Analytics_API_PrivmonUserCsvUploadStats
object
4 properties
4 required
Security_Entity_Analytics_API_EntityRiskScoreRecord
object
18 properties
10 required
Security_Entity_Analytics_API_IndexPattern
string
An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
Security_Entity_Analytics_API_MonitoringEngineDescriptor
object
2 properties
1 required
Security_Entity_Analytics_API_UserName
object
2 properties
Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem
object
3 properties
2 required
Security_Entity_Analytics_API_MonitoringEntitySource
Security_Entity_Analytics_API_MonitoredUserDoc
Security_Entity_Analytics_API_MonitoredUserUpdateDoc
object
4 properties
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Kibana 12
Other APIs Kibana publishes across the network.
Kibana Actions API
Kibana agent builder API
Kibana alerting API
Kibana APM agent configuration API
Kibana APM agent keys API
Kibana APM annotations API
Kibana APM server schema API
Kibana APM sourcemaps API
Kibana cases API
Kibana connectors API
Kibana Data streams API
Kibana data views API
#Security Entity Analytics API