List entities
Base URL
https://{kibana_url}
GET
/api/security/entity_store/entities
Auth
List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.
Privileges
securitySolution
Expand all
filter
string
A Kibana Query Language (KQL) filter for the search-after mode.
size
integer · min: 1 · max: 9007199254740991
Number of entities to return in search-after mode.
searchAfter
string
JSON-encoded search_after value for cursor-based pagination.
source
string []
Fields to include in the response source.
fields
string []
Fields to include in the response.
sort_field
string
Field to sort results by in page mode.
sort_order
enum
Sort order in page mode.
Values:
asc
desc
page
integer · min: 1 · max: 9007199254740991
Page number to return (1-indexed) in page mode.
per_page
integer · min: 1 · max: 10000
Number of entities per page in page mode.
filterQuery
string
An Elasticsearch query string to filter entities in page mode.
entity_types
enum []
Entity types to include in the results.
Values:
user
host
service
generic
200
Indicates a successful response.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc
1
2
curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
"${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc"
Response
No entities matched the query.
Show more
The provided Kibana Query Language filter could not be parsed.
Show more
1
2
3
4
5
6
{
"page": 1,
"per_page": 10,
"records": [],
"total": 0
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "Invalid filter: Expected \u0022(\u0022, \u0022{\u0022, value, whitespace but \u0022:\u0022 found.\ninvalid :: query\n---------^",
"statusCode": 400
}