Manually assign entities to a watchlist

Base URL: https://{kibana_url}

POST /api/entity_analytics/watchlists/{watchlist_id}/entities/assign
POST /s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/entities/assign

Auth

Assigns the provided entities to the specified watchlist using a "manual" source label. The entities must already exist in the entity store.

If an entity is already on the watchlist, no new document is created — the "manual" label is added to its existing source labels instead.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
watchlist_id string required: The ID of the watchlist to add entities to; Example: high-risk-vendors

Request body

euids string[] required: The EUIDs of the entities to assign

Response

Assignment successful

application/json

failed integer required: Number of entities that failed to process
items object[] required
not_found integer required: Number of entities not found in the entity store
successful integer required: Number of entities successfully assigned
total integer required: Total number of entities processed

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/entity_analytics/watchlists/high-risk-vendors/entities/assign
{
  "euids": [
    "user:john.doe",
    "host:web-01"
  ]
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/entity_analytics/watchlists/high-risk-vendors/entities/assign" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "euids": [
      "user:john.doe",
      "host:web-01"
    ]
  }'

Generated from the API spec

Response

{
  "failed": 0,
  "items": [
    {
      "euid": "user:john.doe",
      "status": "success"
    },
    {
      "euid": "host:web-01",
      "status": "not_found"
    }
  ],
  "not_found": 1,
  "successful": 1,
  "total": 2
}