Type to search.

Get risk score history for an entity

Base URL
https://{kibana_url}
  • GET /api/risk_score/history
  • GET /s/{space_id}/api/risk_score/history
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

entity_type enum required

The type of entity to retrieve history for.

Values: host user service generic
entity_id string · max length: 1000 required

The identifier of the entity to retrieve history for.

from string · max length: 100 · default: now-90d

Start of the time range, in date-math syntax. Defaults to 90 days ago.

to string · max length: 100 · default: now

End of the time range, in date-math syntax. Defaults to now.

score_type enum

Filter entries by the type of score recorded (base, propagated, or resolution).

Values: base propagated resolution
include_contributions boolean · default: false

When true, each entry also includes the contributions recorded for that scoring run (inputs, modifiers, category 2 fields, and criticality_level), when present on the underlying document.

Responses

Successful response

application/json
entity_id string · max length: 1000 required
entity_type enum required
Values: host user service generic
entries object[] required
@timestamp string · format: date-time · max length: 33 required
calculated_level enum required
Values: Unknown Low Moderate High Critical
calculated_score number · format: double
calculated_score_norm number · format: double · min: 0 · max: 100 required
category_1_count integer
category_1_score number · format: double
category_2_count integer
category_2_score number · format: double
criticality_level enum

The criticality level of the asset.

Values: low_impact medium_impact high_impact extreme_impact
score_type enum
Values: base propagated resolution
interval string · max length: 10 required

The effective Elasticsearch date_histogram interval expression the entries were aggregated into (for example 3h, 1d, 1w), derived from the requested time range.

400

Invalid request