Type to search.

Update an existing watchlist

Base URL
https://{kibana_url}
  • PUT /api/entity_analytics/watchlists/{id}
  • PUT /s/{space_id}/api/entity_analytics/watchlists/{id}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string · max length: 256 required

The ID of the watchlist to update

Request body

description string · max length: 1000

Description of the watchlist

managed boolean

Indicates if the watchlist is managed by the system

name string · max length: 256 required

Unique name of the watchlist

riskModifier number · min: 0 · max: 2 required

Risk score modifier associated with the watchlist

Response

Watchlist updated successfully

application/json
createdAt string · format: date-time

Timestamp indicating when the watchlist was created

description string

Description of the watchlist

entityCount number

Number of entities in the watchlist

entitySourceIds string[]

List of entity source IDs associated with the watchlist

hasManualEntities boolean

Indicates whether the watchlist contains manually assigned entities

id string

The unique ID of the watchlist

managed boolean required

Indicates if the watchlist is managed by the system

name string required

The name of the watchlist

riskModifier number required

Risk score modifier associated with the watchlist

updatedAt string · format: date-time

Timestamp indicating when the watchlist was last updated