Update a monitored user

PUT /api/entity_analytics/monitoring/users/{id}

Api key auth

Spaces method and path for this operation:

put /s/{space_id}/api/entity_analytics/monitoring/users/{id}

Refer to Spaces for more information.

Updates the details of an existing monitored privileged user by their document ID.

Path parameters

id string Required

The document ID of the monitored user to update

application/json

Body Required

entity_analytics_monitoring object
Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
- labels array[object]
  Hide labels attributes Show labels attributes object
  
  field string Required
  
  source string Required
  
  value string Required
id string
labels object
Hide labels attributes Show labels attributes object
- source_ids array[string]
- source_integrations array[string]
- sources array
  
  Values are csv, index_sync, or api.
user object
Hide user attributes Show user attributes object
- is_privileged boolean
  
  Indicates if the user is privileged.
- name string

Responses

200 application/json

User updated successfully
Hide response attributes Show response attributes object
- entity_analytics_monitoring object
  
  Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
  
  labels array[object]
  
  Hide labels attributes Show labels attributes object
  
  field string Required
  
  source string Required
  
  value string Required
- id string
- labels object
  
  Hide labels attributes Show labels attributes object
  
  source_ids array[string]
  
  source_integrations array[string]
  
  sources array
  
  Values are csv, index_sync, or api.
- user object
  
  Hide user attributes Show user attributes object
  
  is_privileged boolean
  
  Indicates if the user is privileged.
  
  name string
  
  entity object
  
  Hide entity attribute Show entity attribute object
  
  attributes object
  
  Hide attributes attribute Show attributes attribute object
  
  Privileged boolean
  
  Indicates if the user is privileged.
- @timestamp string(date-time)
- event object
  
  Hide event attributes Show event attributes object
  
  @timestamp string(date-time)
  
  ingested string(date-time)

PUT /api/entity_analytics/monitoring/users/{id}

curl \
 --request PUT 'https://<KIBANA_URL>/api/entity_analytics/monitoring/users/{id}' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"entity_analytics_monitoring":{"labels":[{"field":"department","source":"api","value":"Security"}]},"user":{"is_privileged":true,"name":"john.doe"}}'

Request example

{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Response examples (200)

{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}