Type to search.

Manually unassign entities from a watchlist

Base URL
https://{kibana_url}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Unassigns the provided entities from the specified watchlist. This only removes the "manual" assignment. If the entity is also assigned via other sources (for example, index or integration), it will remain on the watchlist.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

watchlist_id string required

The ID of the watchlist to remove entities from

Example: high-risk-vendors

Request body

euids string[] required

The EUIDs of the entities to unassign

Response

Unassignment successful

application/json
failed integer required

Number of entities that failed to process

items object[] required
error string

Error message if the entity failed to process

euid string required

The EUID of the entity

status enum required
Values: success failure not_found
not_found integer required

Number of entities not found in the manual watchlist assignment

successful integer required

Number of entities successfully unassigned

total integer required

Total number of entities processed