List Entity Store Entities

GET /api/entity_store/entities/list

Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/entity_store/entities/list

Refer to Spaces for more information.

List entities records, paging, sorting and filtering as needed.

Query parameters

sort_field string

Field to sort results by.
sort_order string

Sort order.

Values are asc or desc.
page integer

Page number to return (1-indexed).

Minimum value is 1.
per_page integer

Number of entities per page.

Minimum value is 1, maximum value is 10000.
filterQuery string

An ES query to filter by.
entity_types array[string] Required

Entity types to include in the results.

Values are user, host, or service.

Responses

200 application/json

Entities returned successfully
Hide response attributes Show response attributes object
- inspect object
  
  Debug information about the Elasticsearch query executed.
  
  Hide inspect attributes Show inspect attributes object
  
  dsl array[string] Required
  
  Elasticsearch query DSL that was executed.
  
  response array[string] Required
  
  Raw Elasticsearch responses.
- page integer Required
  
  Current page number.
  
  Minimum value is 1.
- per_page integer Required
  
  Number of entities per page.
  
  Minimum value is 1, maximum value is 1000.
- records array[object] Required
  
  The entity records for this page.
  
  An entity record from the Entity Store. The entity namespace is a root-level field in the latest index, unlike source logs where it is nested under host, user, or service.
  
  One of:
  Security_Entity_Analytics_API_UserEntity object Security_Entity_Analytics_API_HostEntity object Security_Entity_Analytics_API_ServiceEntity object
  
  An entity record representing a user, stored in the Entity Store latest index.
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  asset object
  
  Hide asset attribute Show asset attribute object
  
  criticality string Required
  
  The criticality level of the asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  entity object Required
  
  Hide entity attributes Show entity attributes object
  
  name string Required
  
  source string Required
  
  event object
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  user object Required
  
  Elastic Common Schema (ECS) user fields collected on the entity.
  
  Hide user attributes Show user attributes object
  
  domain array[string]
  
  Observed user domains.
  
  email array[string]
  
  Observed email addresses.
  
  full_name array[string]
  
  Observed full names of the user.
  
  hash array[string]
  
  Observed user hashes.
  
  id array[string]
  
  Observed user IDs.
  
  name string Required
  
  Primary user name.
  
  risk object
  
  Hide risk attributes Show risk attributes object
  
  @timestamp string(date-time) Required
  
  The time at which the risk score was calculated.
  
  calculated_level string Required
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number(double) Required
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number(double) Required
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  category_1_count integer Required
  
  The number of risk input documents that contributed to the Category 1 score (category_1_score).
  
  category_1_score number(double) Required
  
  The contribution of Category 1 to the overall risk score (calculated_score). Category 1 contains Detection Engine Alerts.
  
  category_2_count integer
  
  category_2_score number(double)
  
  criticality_level string
  
  The criticality level of the asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  criticality_modifier number(double)
  
  id_field string Required
  
  The identifier field defining this risk score. Coupled with id_value, uniquely identifies the entity being scored.
  
  id_value string Required
  
  The identifier value defining this risk score. Coupled with id_field, uniquely identifies the entity being scored.
  
  inputs array[object] Required
  
  A list of the highest-risk documents contributing to this risk score. Useful for investigative purposes.
  
  Hide inputs attributes Show inputs attributes object
  
  A generic representation of a document contributing to a Risk Score.
  
  category string Required
  
  The risk category of the risk input document.
  
  contribution_score number(double)
  
  description string Required
  
  A human-readable description of the risk input document.
  
  id string Required
  
  The unique identifier (_id) of the original source document
  
  index string Required
  
  The unique index (_index) of the original source document
  
  risk_score number(double)
  
  The weighted risk score of the risk input document.
  
  Minimum value is 0, maximum value is 100.
  
  timestamp string
  
  The @timestamp of the risk input document.
  
  notes array[string] Required
  
  roles array[string]
  
  Observed roles assigned to the user.
  
  An entity record representing a host, stored in the Entity Store latest index.
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  asset object
  
  Hide asset attribute Show asset attribute object
  
  criticality string Required
  
  The criticality level of the asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  entity object Required
  
  Hide entity attributes Show entity attributes object
  
  name string Required
  
  source string Required
  
  event object
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  host object Required
  
  Elastic Common Schema (ECS) host fields collected on the entity.
  
  Hide host attributes Show host attributes object
  
  architecture array[string]
  
  Observed CPU architectures.
  
  domain array[string]
  
  Observed host domains.
  
  hostname array[string]
  
  Observed hostnames.
  
  id array[string]
  
  Observed host IDs.
  
  ip array[string]
  
  Observed IP addresses.
  
  mac array[string]
  
  Observed MAC addresses.
  
  name string Required
  
  Primary host name.
  
  risk object
  
  Hide risk attributes Show risk attributes object
  
  @timestamp string(date-time) Required
  
  The time at which the risk score was calculated.
  
  calculated_level string Required
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number(double) Required
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number(double) Required
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  category_1_count integer Required
  
  The number of risk input documents that contributed to the Category 1 score (category_1_score).
  
  category_1_score number(double) Required
  
  The contribution of Category 1 to the overall risk score (calculated_score). Category 1 contains Detection Engine Alerts.
  
  category_2_count integer
  
  category_2_score number(double)
  
  criticality_level string
  
  The criticality level of the asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  criticality_modifier number(double)
  
  id_field string Required
  
  The identifier field defining this risk score. Coupled with id_value, uniquely identifies the entity being scored.
  
  id_value string Required
  
  The identifier value defining this risk score. Coupled with id_field, uniquely identifies the entity being scored.
  
  inputs array[object] Required
  
  A list of the highest-risk documents contributing to this risk score. Useful for investigative purposes.
  
  Hide inputs attributes Show inputs attributes object
  
  A generic representation of a document contributing to a Risk Score.
  
  category string Required
  
  The risk category of the risk input document.
  
  contribution_score number(double)
  
  description string Required
  
  A human-readable description of the risk input document.
  
  id string Required
  
  The unique identifier (_id) of the original source document
  
  index string Required
  
  The unique index (_index) of the original source document
  
  risk_score number(double)
  
  The weighted risk score of the risk input document.
  
  Minimum value is 0, maximum value is 100.
  
  timestamp string
  
  The @timestamp of the risk input document.
  
  notes array[string] Required
  
  type array[string]
  
  Observed host types.
  
  An entity record representing a service, stored in the Entity Store latest index.
  
  Hide attributes Show attributes
  
  @timestamp string(date-time)
  
  The time the entity record was last updated.
  
  asset object
  
  Hide asset attribute Show asset attribute object
  
  criticality string Required
  
  The criticality level of the asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  entity object Required
  
  Hide entity attributes Show entity attributes object
  
  name string Required
  
  source string Required
  
  event object
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
  
  When the event was ingested into Elasticsearch.
  
  service object Required
  
  Elastic Common Schema (ECS) service fields collected on the entity.
  
  Hide service attributes Show service attributes object
  
  name string Required
  
  Primary service name.
  
  risk object
  
  Hide risk attributes Show risk attributes object
  
  @timestamp string(date-time) Required
  
  The time at which the risk score was calculated.
  
  calculated_level string Required
  
  Lexical description of the entity's risk.
  
  Values are Unknown, Low, Moderate, High, or Critical.
  
  calculated_score number(double) Required
  
  The raw numeric value of the given entity's risk score.
  
  calculated_score_norm number(double) Required
  
  The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
  
  Minimum value is 0, maximum value is 100.
  
  category_1_count integer Required
  
  The number of risk input documents that contributed to the Category 1 score (category_1_score).
  
  category_1_score number(double) Required
  
  The contribution of Category 1 to the overall risk score (calculated_score). Category 1 contains Detection Engine Alerts.
  
  category_2_count integer
  
  category_2_score number(double)
  
  criticality_level string
  
  The criticality level of the asset.
  
  Values are low_impact, medium_impact, high_impact, or extreme_impact.
  
  criticality_modifier number(double)
  
  id_field string Required
  
  The identifier field defining this risk score. Coupled with id_value, uniquely identifies the entity being scored.
  
  id_value string Required
  
  The identifier value defining this risk score. Coupled with id_field, uniquely identifies the entity being scored.
  
  inputs array[object] Required
  
  A list of the highest-risk documents contributing to this risk score. Useful for investigative purposes.
  
  Hide inputs attributes Show inputs attributes object
  
  A generic representation of a document contributing to a Risk Score.
  
  category string Required
  
  The risk category of the risk input document.
  
  contribution_score number(double)
  
  description string Required
  
  A human-readable description of the risk input document.
  
  id string Required
  
  The unique identifier (_id) of the original source document
  
  index string Required
  
  The unique index (_index) of the original source document
  
  risk_score number(double)
  
  The weighted risk score of the risk input document.
  
  Minimum value is 0, maximum value is 100.
  
  timestamp string
  
  The @timestamp of the risk input document.
  
  notes array[string] Required
- total integer Required
  
  Total number of entities matching the query.
  
  Minimum value is 0.

GET /api/entity_store/entities/list

curl \
 --request GET 'https://localhost:5601/api/entity_store/entities/list?entity_types=user' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "page": 1,
  "per_page": 10,
  "records": [
    {
      "entity": {
        "id": "web-server-01",
        "name": "web-server-01",
        "type": "host"
      },
      "host": {
        "ip": [
          "10.0.0.1"
        ],
        "name": "web-server-01"
      }
    }
  ],
  "total": 1
}