Link entities
Base URL
https://{kibana_url}
POST
/api/security/entity_store/resolution/link
POST
/s/{space_id} /api/security/entity_store/resolution/link
Auth
Link one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).
Privileges
securitySolution
and
securitySolution-entity-analytics
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
A required header to protect against CSRF attacks
{
}
entity_ids
string [] · min items: 1 · max items: 1000 required
Entity identifiers to link to the target entity. Minimum 1, maximum 1000.
target_id
string required
The entity identifier to resolve the linked entities to.
200
Indicates a successful response.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Link entities to a target
languages
Request
Console
1 / 2 languages
‹
›
1
2
3
4
5
POST kbn://api/security/entity_store/resolution/link
{
"target_id": "user:jane.doe@example.com",
"entity_ids": ["user:jdoe@example.com"]
}
1
2
3
4
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"target_id":"user:jane.doe@example.com","entity_ids":["user:jdoe@example.com"]}' \
"${KIBANA_URL}/api/security/entity_store/resolution/link"
Response
All entities in a resolution group must be of the same type.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "Cannot link entities of different types",
"statusCode": 400
}
Request
Console
1 / 2 languages
‹
›
Link two user entities to a target entity, creating a resolution group.
Show more
1
2
3
4
5
6
7
8
POST kbn:/api/security/entity_store/resolution/link
{
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"target_id": "user:jane.doe@example.com"
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"target_id": "user:jane.doe@example.com"
}' \
"${KIBANA_URL}/api/security/entity_store/resolution/link"
Generated from the API spec
Response
The entities were successfully linked to the target entity.
Show more
All entities in a resolution group must be of the same type.
Show more
1
2
3
4
5
6
7
8
9
{
"entity_type": "user",
"linked": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"skipped": [],
"target_id": "user:jane.doe@example.com"
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "Cannot link entities of different types",
"statusCode": 400
}