Create an entity

POST /api/security/entity_store/entities/{entityType}

Spaces method and path for this operation:

post /s/{space_id}/api/security/entity_store/entities/{entityType}

Refer to Spaces for more information.

Create a new entity record in the Entity Store for the specified entity type.

[Required authorization] Route required privileges: securitySolution.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Path parameters

entityType string Required

The entity type to create.

Values are user, host, service, or generic.

application/json

Body

object

@timestamp string(date-time)

The time the entity record was last updated.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
asset object

Additional properties are NOT allowed.
Hide asset attributes Show asset attributes object
- business_unit string
  
  Business unit the asset belongs to.
- criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
- environment string
  
  Deployment environment (for example, production, staging).
- id string
  
  Unique identifier for the asset.
- model string
  
  Model name or number.
- name string
  
  Human-readable asset name.
- owner string
  
  The owner of the asset.
- serial_number string
  
  Serial number of the asset.
- vendor string
  
  Vendor or manufacturer.
entity object

Additional properties are NOT allowed.
Hide entity attributes Show entity attributes object
- attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
- behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
- created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- EngineMetadata object
  
  Additional properties are NOT allowed.
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
- id string
  
  Unique identifier for this entity.
- lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
- name string
  
  Human-readable name of the entity.
- relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
- risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
- schema_version string
  
  Schema version of the entity record.
- source array[string]
  
  Sources that produced this entity record.
- sub_type string
  
  Optional sub-type classification for the entity.
- type string
  
  The entity type.
- url string
  
  URL associated with the entity.
event object

Additional properties are NOT allowed.
Hide event attribute Show event attribute object
- ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
labels object

Custom key-value labels attached to the entity.

Additional properties are allowed.
tags array[string]

Tags attached to the entity.
user object

Elastic Common Schema (ECS) user fields collected on the entity.

Additional properties are NOT allowed.
Hide user attributes Show user attributes object
- domain array[string]
  
  Observed user domains.
- email array[string]
  
  Observed email addresses.
- full_name array[string]
  
  Observed full names of the user.
- hash array[string]
  
  Observed user hashes.
- id array[string]
  
  Observed user identifiers.
- name string
  
  Primary user name.
- risk object
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score.
  
  Minimum value is 0, maximum value is 100.
- roles array[string]
  
  Observed roles assigned to the user.

@timestamp string(date-time)

The time the entity record was last updated.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
asset object

Additional properties are NOT allowed.
Hide asset attributes Show asset attributes object
- business_unit string
  
  Business unit the asset belongs to.
- criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
- environment string
  
  Deployment environment (for example, production, staging).
- id string
  
  Unique identifier for the asset.
- model string
  
  Model name or number.
- name string
  
  Human-readable asset name.
- owner string
  
  The owner of the asset.
- serial_number string
  
  Serial number of the asset.
- vendor string
  
  Vendor or manufacturer.
entity object

Additional properties are NOT allowed.
Hide entity attributes Show entity attributes object
- attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
- behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
- created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- EngineMetadata object
  
  Additional properties are NOT allowed.
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
- id string
  
  Unique identifier for this entity.
- lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
- name string
  
  Human-readable name of the entity.
- relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
- risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
- schema_version string
  
  Schema version of the entity record.
- source array[string]
  
  Sources that produced this entity record.
- sub_type string
  
  Optional sub-type classification for the entity.
- type string
  
  The entity type.
- url string
  
  URL associated with the entity.
event object

Additional properties are NOT allowed.
Hide event attribute Show event attribute object
- ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
host object

Elastic Common Schema (ECS) host fields collected on the entity.

Additional properties are NOT allowed.
Hide host attributes Show host attributes object
- architecture array[string]
  
  Observed CPU architectures.
- domain array[string]
  
  Observed host domains.
- hostname array[string]
  
  Observed hostnames.
- id array[string]
  
  Observed host identifiers.
- ip array[string]
  
  Observed IP addresses.
- mac array[string]
  
  Observed MAC addresses.
- name string
  
  Primary host name.
- os object
  
  Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
  
  Additional properties are NOT allowed.
  Hide os attributes Show os attributes object
  
  family string
  
  full string
  
  kernel string
  
  name string | array[string]
  
  Any of:
  string-1 string array-2 array[string]
  
  platform string
  
  type string | array[string]
  
  Any of:
  string-1 string array-2 array[string]
  
  version string
- risk object
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score.
  
  Minimum value is 0, maximum value is 100.
- type array[string]
  
  Observed host types.
labels object

Custom key-value labels attached to the entity.

Additional properties are allowed.
tags array[string]

Tags attached to the entity.

@timestamp string(date-time)

The time the entity record was last updated.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
asset object

Additional properties are NOT allowed.
Hide asset attributes Show asset attributes object
- business_unit string
  
  Business unit the asset belongs to.
- criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
- environment string
  
  Deployment environment (for example, production, staging).
- id string
  
  Unique identifier for the asset.
- model string
  
  Model name or number.
- name string
  
  Human-readable asset name.
- owner string
  
  The owner of the asset.
- serial_number string
  
  Serial number of the asset.
- vendor string
  
  Vendor or manufacturer.
entity object

Additional properties are NOT allowed.
Hide entity attributes Show entity attributes object
- attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
- behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
- created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- EngineMetadata object
  
  Additional properties are NOT allowed.
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
- id string
  
  Unique identifier for this entity.
- lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
- name string
  
  Human-readable name of the entity.
- relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
- risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
- schema_version string
  
  Schema version of the entity record.
- source array[string]
  
  Sources that produced this entity record.
- sub_type string
  
  Optional sub-type classification for the entity.
- type string
  
  The entity type.
- url string
  
  URL associated with the entity.
event object

Additional properties are NOT allowed.
Hide event attribute Show event attribute object
- ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
labels object

Custom key-value labels attached to the entity.

Additional properties are allowed.
service object

Elastic Common Schema (ECS) service fields collected on the entity.

Additional properties are NOT allowed.
Hide service attributes Show service attributes object
- address string
  
  Service address.
- environment string
  
  Service environment (for example, production, staging).
- ephemeral_id string
  
  Ephemeral identifier of the service.
- id string
  
  Unique identifier of the service.
- name string
  
  Primary service name.
- node object
  
  Node information for the service.
  
  Additional properties are NOT allowed.
  Hide node attributes Show node attributes object
  
  name string
  
  Node name.
  
  role string
  
  Node role.
  
  roles array[string]
  
  Node roles.
- risk object
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score.
  
  Minimum value is 0, maximum value is 100.
- state string
  
  Current state of the service.
- type string
  
  Service type.
- version string
  
  Service version.
tags array[string]

Tags attached to the entity.

@timestamp string(date-time)

The time the entity record was last updated.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
asset object

Additional properties are NOT allowed.
Hide asset attributes Show asset attributes object
- business_unit string
  
  Business unit the asset belongs to.
- criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
- environment string
  
  Deployment environment (for example, production, staging).
- id string
  
  Unique identifier for the asset.
- model string
  
  Model name or number.
- name string
  
  Human-readable asset name.
- owner string
  
  The owner of the asset.
- serial_number string
  
  Serial number of the asset.
- vendor string
  
  Vendor or manufacturer.
cloud object

Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.

Additional properties are NOT allowed.
Hide cloud attributes Show cloud attributes object
- account object
  
  Additional properties are NOT allowed.
  Hide account attributes Show account attributes object
  
  id string
  
  name string
- availability_zone string
- instance object
  
  Additional properties are NOT allowed.
  Hide instance attributes Show instance attributes object
  
  id string
  
  name string
- machine object
  
  Additional properties are NOT allowed.
  Hide machine attribute Show machine attribute object
  
  type string
- project object
  
  Additional properties are NOT allowed.
  Hide project attributes Show project attributes object
  
  id string
  
  name string
- provider string
- region string
- service object
  
  Additional properties are NOT allowed.
  Hide service attribute Show service attribute object
  
  name string
entity object

Additional properties are NOT allowed.
Hide entity attributes Show entity attributes object
- attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
- behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
- created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
- EngineMetadata object
  
  Additional properties are NOT allowed.
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
- id string
  
  Unique identifier for this entity.
- lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
- name string
  
  Human-readable name of the entity.
- relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
- risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
- schema_version string
  
  Schema version of the entity record.
- source array[string]
  
  Sources that produced this entity record.
- sub_type string
  
  Optional sub-type classification for the entity.
- type string
  
  The entity type.
- url string
  
  URL associated with the entity.
event object

Additional properties are NOT allowed.
Hide event attribute Show event attribute object
- ingested string(date-time)
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
labels object

Additional properties are allowed.
orchestrator object

Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.

Additional properties are NOT allowed.
Hide orchestrator attributes Show orchestrator attributes object
- api_version string
- cluster object
  
  Additional properties are NOT allowed.
  Hide cluster attributes Show cluster attributes object
  
  id string
  
  name string
  
  url string
  
  version string
- namespace string
- organization string
- resource object
  
  Additional properties are NOT allowed.
  Hide resource attributes Show resource attributes object
  
  annotation string
  
  id string
  
  ip string
  
  label string
  
  name string
  
  parent object
  
  Additional properties are NOT allowed.
  
  Hide parent attribute Show parent attribute object
  
  type string
  
  type string
- type string
tags array[string]

Responses

200 application/json

Indicates the entity was successfully created.
400 application/json

Bad request.
409 application/json

Conflict.

POST /api/security/entity_store/entities/{entityType}

curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","source":["manual"],"attributes":{"asset":true}},"host":{"name":"web-server-prod-01","ip":["10.0.1.42"]}}' \
  "${KIBANA_URL}/api/security/entity_store/entities/host"

POST kbn://api/security/entity_store/entities/host
{
  "entity": {
    "id": "host:web-server-prod-01",
    "name": "web-server-prod-01",
    "type": "host",
    "source": ["manual"],
    "attributes": { "asset": true }
  },
  "host": {
    "name": "web-server-prod-01",
    "ip": ["10.0.1.42"]
  }
}

Request example

Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type.

{
  "asset": {
    "business_unit": "Engineering",
    "criticality": "high_impact",
    "environment": "production"
  },
  "entity": {
    "attributes": {
      "asset": true,
      "managed": true
    },
    "id": "host:web-server-prod-01",
    "name": "web-server-prod-01",
    "source": [
      "manual"
    ],
    "type": "host"
  },
  "host": {
    "hostname": [
      "web-server-prod-01.example.com"
    ],
    "ip": [
      "10.0.1.42"
    ],
    "name": "web-server-prod-01"
  }
}

Response examples (200)

The entity record was successfully created in the Entity Store.

{
  "ok": true
}

Response examples (400)

The supplied entity identifier does not match the auto-generated identifier derived from the entity fields.

{
  "error": "Bad Request",
  "message": "Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01",
  "statusCode": 400
}

Response examples (409)

An entity with the specified identifier already exists.

{
  "error": "Conflict",
  "message": "Entity ID 'host:web-server-prod-01' already exists",
  "statusCode": 409
}