Install the Entity Store
Base URL
https://{kibana_url}
POST
/api/security/entity_store/install
Auth
Install the Entity Store and create engines for the specified entity types. A single logExtraction configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the default value. To change settings after install, use the update endpoint.
Privileges
securitySolution
Expand all
A required header to protect against CSRF attacks
{
}
entityTypes
enum [] · default: ["user","host","service","generic"]
Values:
user
host
service
generic
historySnapshot
object
+
Show 1 property
frequency
string · max length: 32 · pattern: [smdh]$ · default: 24h
+
Show 11 properties
200
Indicates all requested entity types are already installed.
application/json
201
Indicates the Entity Store was successfully installed.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Install with default entity types
languages
Install with custom log extraction
languages
Request
Console
1 / 2 languages
‹
›
Install the Entity Store for all entity types with default log extraction settings.
Show more
1
2
3
4
5
POST kbn://api/security/entity_store/install
{
"entityTypes": ["user", "host", "service", "generic"],
"logExtraction": {}
}
1
2
3
4
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"entityTypes":["user","host","service","generic"],"logExtraction":{}}' \
"${KIBANA_URL}/api/security/entity_store/install"
Response
All requested entity types were already installed.
Show more
The Entity Store was installed and engines are being created.
Show more
The user does not have the required Elasticsearch privileges.
Show more
1
2
3
4
5
{
"error": "Forbidden",
"message": "User \u0027analyst\u0027 has insufficient privileges",
"statusCode": 403
}
Request
Console
1 / 2 languages
‹
›
Install the Entity Store for host entities only with a custom lookback period and field history length.
Show more
1
2
3
4
5
6
7
8
9
10
11
12
POST kbn:/api/security/entity_store/install
{
"entityTypes": [
"host"
],
"logExtraction": {
"delay": "2m",
"fieldHistoryLength": 20,
"frequency": "5m",
"lookbackPeriod": "12h"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"entityTypes": [
"host"
],
"logExtraction": {
"delay": "2m",
"fieldHistoryLength": 20,
"frequency": "5m",
"lookbackPeriod": "12h"
}
}' \
"${KIBANA_URL}/api/security/entity_store/install"
Generated from the API spec
Response
All requested entity types were already installed.
Show more
The Entity Store was installed and engines are being created.
Show more
The user does not have the required Elasticsearch privileges.
Show more
1
2
3
4
5
{
"error": "Forbidden",
"message": "User \u0027analyst\u0027 has insufficient privileges",
"statusCode": 403
}