Upload a CSV file to add entities to a watchlist

Base URL: https://{kibana_url}

POST /api/entity_analytics/watchlists/{watchlist_id}/csv_upload
POST /s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/csv_upload

Auth

Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row with a "type" column (user, host, service, or generic) and one or more ECS identity fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.

Matched entities are added to the watchlist and their entity.attributes.watchlists field is updated in the entity store.

Each row will match up to 10,000 entities.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
watchlist_id string required: The ID of the watchlist to add entities to; Example: high-risk-vendors

Request body

file string · format: binary required: The CSV file to upload.

Responses

Upload successful

application/json

failed integer required: Number of rows that failed to process
items object[] required
successful integer required: Number of rows that matched at least one entity
total integer required: Total number of rows processed
unmatched integer required: Number of rows that matched no entities

413

File too large