Bulk update entities

PUT /api/security/entity_store/entities/bulk

Spaces method and path for this operation:

put /s/{space_id}/api/security/entity_store/entities/bulk

Refer to Spaces for more information.

Update multiple entity records in the Entity Store in a single request.

[Required authorization] Route required privileges: securitySolution.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Query parameters

force string | boolean

When true, allows updating protected fields.

Values are true or false. Default value is false.

application/json

Body

entities array[object] Required

The entities to update.
Hide entities attributes Show entities attributes object
- doc object
  
  Any of:
  object-1 object object-2 object object-3 object object-4 object
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  asset object
  
  Additional properties are NOT allowed.
  
  Hide asset attributes Show asset attributes object
  
  business_unit string
  
  Business unit the asset belongs to.
  
  criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  environment string
  
  Deployment environment (for example, production, staging).
  
  id string
  
  Unique identifier for the asset.
  
  model string
  
  Model name or number.
  
  name string
  
  Human-readable asset name.
  
  owner string
  
  The owner of the asset.
  
  serial_number string
  
  Serial number of the asset.
  
  vendor string
  
  Vendor or manufacturer.
  
  entity object
  
  Additional properties are NOT allowed.
  
  Hide entity attributes Show entity attributes object
  
  attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
  
  behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
  
  created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
  
  EngineMetadata object
  
  Additional properties are NOT allowed.
  
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
  
  id string
  
  Unique identifier for this entity.
  
  lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  name string
  
  Human-readable name of the entity.
  
  relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  schema_version string
  
  Schema version of the entity record.
  
  source array[string]
  
  Sources that produced this entity record.
  
  sub_type string
  
  Optional sub-type classification for the entity.
  
  type string
  
  The entity type.
  
  url string
  
  URL associated with the entity.
  
  event object
  
  Additional properties are NOT allowed.
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  labels object
  
  Custom key-value labels attached to the entity.
  
  Additional properties are allowed.
  
  tags array[string]
  
  Tags attached to the entity.
  
  user object
  
  Elastic Common Schema (ECS) user fields collected on the entity.
  
  Additional properties are NOT allowed.
  
  Hide user attributes Show user attributes object
  
  domain array[string]
  
  Observed user domains.
  
  email array[string]
  
  Observed email addresses.
  
  full_name array[string]
  
  Observed full names of the user.
  
  hash array[string]
  
  Observed user hashes.
  
  id array[string]
  
  Observed user identifiers.
  
  name string
  
  Primary user name.
  
  risk object
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score.
  
  Minimum value is 0, maximum value is 100.
  
  roles array[string]
  
  Observed roles assigned to the user.
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  asset object
  
  Additional properties are NOT allowed.
  
  Hide asset attributes Show asset attributes object
  
  business_unit string
  
  Business unit the asset belongs to.
  
  criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  environment string
  
  Deployment environment (for example, production, staging).
  
  id string
  
  Unique identifier for the asset.
  
  model string
  
  Model name or number.
  
  name string
  
  Human-readable asset name.
  
  owner string
  
  The owner of the asset.
  
  serial_number string
  
  Serial number of the asset.
  
  vendor string
  
  Vendor or manufacturer.
  
  entity object
  
  Additional properties are NOT allowed.
  
  Hide entity attributes Show entity attributes object
  
  attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
  
  behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
  
  created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
  
  EngineMetadata object
  
  Additional properties are NOT allowed.
  
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
  
  id string
  
  Unique identifier for this entity.
  
  lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  name string
  
  Human-readable name of the entity.
  
  relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  schema_version string
  
  Schema version of the entity record.
  
  source array[string]
  
  Sources that produced this entity record.
  
  sub_type string
  
  Optional sub-type classification for the entity.
  
  type string
  
  The entity type.
  
  url string
  
  URL associated with the entity.
  
  event object
  
  Additional properties are NOT allowed.
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  host object
  
  Elastic Common Schema (ECS) host fields collected on the entity.
  
  Additional properties are NOT allowed.
  
  Hide host attributes Show host attributes object
  
  architecture array[string]
  
  Observed CPU architectures.
  
  domain array[string]
  
  Observed host domains.
  
  hostname array[string]
  
  Observed hostnames.
  
  id array[string]
  
  Observed host identifiers.
  
  ip array[string]
  
  Observed IP addresses.
  
  mac array[string]
  
  Observed MAC addresses.
  
  name string
  
  Primary host name.
  
  os object
  
  Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
  
  Additional properties are NOT allowed.
  
  Hide os attributes Show os attributes object
  
  family string
  
  full string
  
  kernel string
  
  name string | array[string]
  
  Any of:
  string-1 string array-2 array[string]
  
  platform string
  
  type string | array[string]
  
  Any of:
  string-1 string array-2 array[string]
  
  version string
  
  risk object
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score.
  
  Minimum value is 0, maximum value is 100.
  
  type array[string]
  
  Observed host types.
  
  labels object
  
  Custom key-value labels attached to the entity.
  
  Additional properties are allowed.
  
  tags array[string]
  
  Tags attached to the entity.
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  asset object
  
  Additional properties are NOT allowed.
  
  Hide asset attributes Show asset attributes object
  
  business_unit string
  
  Business unit the asset belongs to.
  
  criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  environment string
  
  Deployment environment (for example, production, staging).
  
  id string
  
  Unique identifier for the asset.
  
  model string
  
  Model name or number.
  
  name string
  
  Human-readable asset name.
  
  owner string
  
  The owner of the asset.
  
  serial_number string
  
  Serial number of the asset.
  
  vendor string
  
  Vendor or manufacturer.
  
  entity object
  
  Additional properties are NOT allowed.
  
  Hide entity attributes Show entity attributes object
  
  attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
  
  behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
  
  created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
  
  EngineMetadata object
  
  Additional properties are NOT allowed.
  
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
  
  id string
  
  Unique identifier for this entity.
  
  lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  name string
  
  Human-readable name of the entity.
  
  relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  schema_version string
  
  Schema version of the entity record.
  
  source array[string]
  
  Sources that produced this entity record.
  
  sub_type string
  
  Optional sub-type classification for the entity.
  
  type string
  
  The entity type.
  
  url string
  
  URL associated with the entity.
  
  event object
  
  Additional properties are NOT allowed.
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  labels object
  
  Custom key-value labels attached to the entity.
  
  Additional properties are allowed.
  
  service object
  
  Elastic Common Schema (ECS) service fields collected on the entity.
  
  Additional properties are NOT allowed.
  
  Hide service attributes Show service attributes object
  
  address string
  
  Service address.
  
  environment string
  
  Service environment (for example, production, staging).
  
  ephemeral_id string
  
  Ephemeral identifier of the service.
  
  id string
  
  Unique identifier of the service.
  
  name string
  
  Primary service name.
  
  node object
  
  Node information for the service.
  
  Additional properties are NOT allowed.
  
  Hide node attributes Show node attributes object
  
  name string
  
  Node name.
  
  role string
  
  Node role.
  
  roles array[string]
  
  Node roles.
  
  risk object
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score.
  
  Minimum value is 0, maximum value is 100.
  
  state string
  
  Current state of the service.
  
  type string
  
  Service type.
  
  version string
  
  Service version.
  
  tags array[string]
  
  Tags attached to the entity.
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  asset object
  
  Additional properties are NOT allowed.
  
  Hide asset attributes Show asset attributes object
  
  business_unit string
  
  Business unit the asset belongs to.
  
  criticality string | null
  
  The criticality level assigned to this asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  environment string
  
  Deployment environment (for example, production, staging).
  
  id string
  
  Unique identifier for the asset.
  
  model string
  
  Model name or number.
  
  name string
  
  Human-readable asset name.
  
  owner string
  
  The owner of the asset.
  
  serial_number string
  
  Serial number of the asset.
  
  vendor string
  
  Vendor or manufacturer.
  
  cloud object
  
  Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
  
  Additional properties are NOT allowed.
  
  Hide cloud attributes Show cloud attributes object
  
  account object
  
  Additional properties are NOT allowed.
  
  Hide account attributes Show account attributes object
  
  id string
  
  name string
  
  availability_zone string
  
  instance object
  
  Additional properties are NOT allowed.
  
  Hide instance attributes Show instance attributes object
  
  id string
  
  name string
  
  machine object
  
  Additional properties are NOT allowed.
  
  Hide machine attribute Show machine attribute object
  
  type string
  
  project object
  
  Additional properties are NOT allowed.
  
  Hide project attributes Show project attributes object
  
  id string
  
  name string
  
  provider string
  
  region string
  
  service object
  
  Additional properties are NOT allowed.
  
  Hide service attribute Show service attribute object
  
  name string
  
  entity object
  
  Additional properties are NOT allowed.
  
  Hide entity attributes Show entity attributes object
  
  attributes object
  
  Boolean flags describing characteristics of the entity.
  
  Additional properties are NOT allowed.
  
  Hide attributes attributes Show attributes attributes object
  
  asset boolean
  
  Whether the entity is classified as an asset.
  
  known_redirects array[string]
  
  Known redirect URIs or URLs (e.g. OAuth application callbacks).
  
  managed boolean
  
  Whether the entity is managed (for example, via a directory service).
  
  mfa_enabled boolean
  
  Whether multi-factor authentication is enabled for the entity.
  
  oauth_consent_restriction string
  
  OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
  
  permissions array[string]
  
  Action-level permissions granted to this entity (not roles or groups).
  
  storage_class string
  
  Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
  
  watchlists array[string]
  
  Watchlist identifiers the entity belongs to (v2).
  
  behaviors object
  
  Behavioral signals observed for the entity.
  
  Additional properties are NOT allowed.
  
  Hide behaviors attributes Show behaviors attributes object
  
  anomaly_job_ids array[string]
  
  Machine learning anomaly job identifiers (v2).
  
  rule_names array[string]
  
  Detection rule names that flagged this entity (v2).
  
  created_by string
  
  Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
  
  EngineMetadata object
  
  Additional properties are NOT allowed.
  
  Hide EngineMetadata attribute Show EngineMetadata attribute object
  
  Type string
  
  The engine type that produced this entity record.
  
  id string
  
  Unique identifier for this entity.
  
  lifecycle object
  
  Timestamps tracking the entity lifecycle.
  
  Additional properties are NOT allowed.
  
  Hide lifecycle attributes Show lifecycle attributes object
  
  first_seen string(date-time)
  
  When the entity was first observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_activity string(date-time)
  
  When the entity last generated activity.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  last_seen string(date-time)
  
  When the entity was last observed.
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  name string
  
  Human-readable name of the entity.
  
  relationships object
  
  Connections between this entity and other entities.
  
  Additional properties are NOT allowed.
  
  Hide relationships attributes Show relationships attributes object
  
  accesses_frequently object
  
  Entities this entity accesses frequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_frequently attributes Show accesses_frequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  accesses_infrequently object
  
  Entities this entity accesses infrequently.
  
  Additional properties are NOT allowed.
  
  Hide accesses_infrequently attributes Show accesses_infrequently attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  administers object
  
  Entities this entity administers (for example, a user who is an admin of a service).
  
  Additional properties are NOT allowed.
  
  Hide administers attributes Show administers attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  communicates_with object
  
  Entities this entity communicates with.
  
  Additional properties are NOT allowed.
  
  Hide communicates_with attributes Show communicates_with attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  depends_on object
  
  Entities this entity depends on.
  
  Additional properties are NOT allowed.
  
  Hide depends_on attributes Show depends_on attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns object
  
  Entities owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns attributes Show owns attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  owns_inferred object
  
  Entities inferred to be owned by this entity.
  
  Additional properties are NOT allowed.
  
  Hide owns_inferred attributes Show owns_inferred attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  resolution object
  
  Resolution metadata linking this entity to another.
  
  Additional properties are NOT allowed.
  
  Hide resolution attributes Show resolution attributes object
  
  resolved_to string
  
  entity.id of the entity this one resolves to
  
  risk object
  
  Aggregated risk score for the resolution group.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the resolution group's aggregated risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the resolution group's aggregated risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the resolution group's aggregated risk score.
  
  Minimum value is 0, maximum value is 100.
  
  supervises object
  
  Entities supervised by this entity.
  
  Additional properties are NOT allowed.
  
  Hide supervises attributes Show supervises attributes object
  
  ids array[string]
  
  Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
  
  raw_identifiers object
  
  Additional properties are NOT allowed.
  
  Hide raw_identifiers attributes Show raw_identifiers attributes object
  
  entity.id array[string]
  
  host.id array[string]
  
  host.name array[string]
  
  service.name array[string]
  
  user.email array[string]
  
  user.id array[string]
  
  user.name array[string]
  
  risk object
  
  Risk scoring information for the entity.
  
  Additional properties are NOT allowed.
  
  Hide risk attributes Show risk attributes object
  
  calculated_level string
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  schema_version string
  
  Schema version of the entity record.
  
  source array[string]
  
  Sources that produced this entity record.
  
  sub_type string
  
  Optional sub-type classification for the entity.
  
  type string
  
  The entity type.
  
  url string
  
  URL associated with the entity.
  
  event object
  
  Additional properties are NOT allowed.
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
  
  labels object
  
  Additional properties are allowed.
  
  orchestrator object
  
  Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
  
  Additional properties are NOT allowed.
  
  Hide orchestrator attributes Show orchestrator attributes object
  
  api_version string
  
  cluster object
  
  Additional properties are NOT allowed.
  
  Hide cluster attributes Show cluster attributes object
  
  id string
  
  name string
  
  url string
  
  version string
  
  namespace string
  
  organization string
  
  resource object
  
  Additional properties are NOT allowed.
  
  Hide resource attributes Show resource attributes object
  
  annotation string
  
  id string
  
  ip string
  
  label string
  
  name string
  
  parent object
  
  Additional properties are NOT allowed.
  
  Hide parent attribute Show parent attribute object
  
  type string
  
  type string
  
  type string
  
  tags array[string]
- type string Required
  
  The entity type of this record.
  
  Values are user, host, service, or generic.

Responses

200 application/json

Indicates a successful response.
400 application/json

Bad request.

PUT /api/security/entity_store/entities/bulk

curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"entities":[{"type":"host","doc":{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","attributes":{"asset":true}},"host":{"name":"web-server-prod-01"}}}]}' \
  "${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true"

PUT kbn://api/security/entity_store/entities/bulk?force=true
{
  "entities": [
    {
      "type": "host",
      "doc": {
        "entity": {
          "id": "host:web-server-prod-01",
          "name": "web-server-prod-01",
          "type": "host",
          "attributes": { "asset": true }
        },
        "host": { "name": "web-server-prod-01" }
      }
    }
  ]
}

Request example

Update a host entity and a user entity in a single request.

{
  "entities": [
    {
      "doc": {
        "entity": {
          "attributes": {
            "asset": true
          },
          "id": "host:web-server-prod-01",
          "name": "web-server-prod-01",
          "type": "host"
        },
        "host": {
          "name": "web-server-prod-01"
        }
      },
      "type": "host"
    },
    {
      "doc": {
        "entity": {
          "attributes": {
            "managed": true
          },
          "id": "user:jane.doe@example.com",
          "name": "jane.doe",
          "type": "user"
        },
        "user": {
          "name": "jane.doe"
        }
      },
      "type": "user"
    }
  ]
}

Response examples (200)

Some entities were updated but others encountered Elasticsearch-level errors.

{
  "errors": [
    {
      "_id": "5de9f93a68a72532e736bf5a6184b06300b9cabf",
      "reason": "[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing",
      "status": 404,
      "type": "document_missing_exception"
    }
  ],
  "ok": true
}

All entities were successfully updated with no errors.

{
  "errors": [],
  "ok": true
}

Response examples (400)

The request attempts to update protected fields without the force query parameter.

{
  "error": "Bad Request",
  "message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
  "statusCode": 400
}