Update the Entity Store
Base URL
https://{kibana_url}
PUT
/api/security/entity_store
PUT
/s/{space_id} /api/security/entity_store
Auth
Update the Entity Store configuration without reinstalling. Send logExtraction to change log extraction settings. Omitting a log extraction field leaves it unchanged. Sending null for a log extraction field clears that override and reverts to the entity type default (for frequency: 1m for host and user, 10m for service, 30m for generic). Send historySnapshot.frequency to change the snapshot interval (at least 1 hour) and historySnapshot.retentionDays to change how long snapshots are kept. Omitting either history snapshot field leaves it unchanged. At least one of logExtraction, excludedUserNames or historySnapshot is required.
Privileges
securitySolution
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
A required header to protect against CSRF attacks
{
}
excludedUserNames
string [] · max items: 200
historySnapshot
object
+
Show 2 properties
frequency
string · max length: 32 · pattern: [smdh]$
retentionDays
integer · min: 1 · max: 3650
+
Show 11 properties
200
Indicates a successful response.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Clear log extraction overrides
languages
Update history snapshot settings
languages
Update log extraction settings
languages
Request
Console
1 / 4 languages
‹
›
1
2
3
4
5
6
7
8
PUT kbn://api/security/entity_store
{
"logExtraction": {
"lookbackPeriod": "6h",
"frequency": "10m",
"fieldHistoryLength": 15
}
}
1
2
3
4
5
6
7
PUT kbn://api/security/entity_store
{
"historySnapshot": {
"frequency": "12h",
"retentionDays": 90
}
}
1
2
3
4
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"logExtraction":{"lookbackPeriod":"6h","frequency":"10m","fieldHistoryLength":15}}' \
"${KIBANA_URL}/api/security/entity_store"
1
2
3
4
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"historySnapshot":{"frequency":"12h","retentionDays":90}}' \
"${KIBANA_URL}/api/security/entity_store"
Response
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
Request
Console
1 / 2 languages
‹
›
Send null for any field to clear that override and revert it to the entity type default. For frequency, that is 1m for host and user, 10m for service and 30m for generic.
Show more
1
2
3
4
5
6
7
PUT kbn:/api/security/entity_store
{
"logExtraction": {
"delay": "null",
"frequency": "null"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"logExtraction": {
"delay": "null",
"frequency": "null"
}
}' \
"${KIBANA_URL}/api/security/entity_store"
Generated from the API spec
Response
The Entity Store configuration was successfully updated.
Show more
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
Request
Console
1 / 2 languages
‹
›
Update the history snapshot interval and retention. Omit a field to leave it unchanged.
Show more
1
2
3
4
5
6
7
PUT kbn:/api/security/entity_store
{
"historySnapshot": {
"frequency": "12h",
"retentionDays": 90
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"historySnapshot": {
"frequency": "12h",
"retentionDays": 90
}
}' \
"${KIBANA_URL}/api/security/entity_store"
Generated from the API spec
Response
The Entity Store configuration was successfully updated.
Show more
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
Request
Console
1 / 2 languages
‹
›
Update the log extraction configuration with a new lookback period and frequency.
Show more
1
2
3
4
5
6
7
8
PUT kbn:/api/security/entity_store
{
"logExtraction": {
"fieldHistoryLength": 15,
"frequency": "10m",
"lookbackPeriod": "6h"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"logExtraction": {
"fieldHistoryLength": 15,
"frequency": "10m",
"lookbackPeriod": "6h"
}
}' \
"${KIBANA_URL}/api/security/entity_store"
Generated from the API spec
Response
The Entity Store configuration was successfully updated.
Show more
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}