List all monitored users

GET /api/entity_analytics/monitoring/users/list
Api key auth Basic auth

Query parameters

  • kql string

    KQL query to filter the list of monitored users

Responses

  • 200 application/json

    List of monitored users

    Hide response attributes Show response attributes object
    • @timestamp string(date-time)
    • entity_analytics_monitoring object
      Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
      • labels array[object]
        Hide labels attributes Show labels attributes object
        • field string
        • source string
        • value string
    • event object
      Hide event attribute Show event attribute object
      • ingested string(date-time)
    • id string
    • labels object
      Hide labels attributes Show labels attributes object
      • source_indices array[string]
      • source_integrations array[string]
      • sources array

        Values are csv, index_sync, or api.

    • user object
      Hide user attributes Show user attributes object
      • is_privileged boolean

        Indicates if the user is privileged.

      • name string
GET /api/entity_analytics/monitoring/users/list 
curl \
 --request GET 'https://localhost:5601/api/entity_analytics/monitoring/users/list' \
 --header "Authorization: $API_KEY"