Link entities
Base URL
https://{kibana_url}
POST
/api/security/entity_store/resolution/link
Auth
Stack
9.4+
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Generally available since 9.4
This functionality is generally available and ready for production usage.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Link one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).
Privileges
securitySolution
and
securitySolution-entity-analytics
Expand all
A required header to protect against CSRF attacks
{
}
entity_ids
string [] · min items: 1 · max items: 1000 required
Entity identifiers to link to the target entity. Minimum 1, maximum 1000.
target_id
string required
The entity identifier to resolve the linked entities to.
200
Indicates a successful response.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Link entities to a target
languages
Request
Console
1 / 2 languages
‹
›
1
2
3
4
5
POST kbn://api/security/entity_store/resolution/link
{
"target_id": "user:jane.doe@example.com",
"entity_ids": ["user:jdoe@example.com"]
}
1
2
3
4
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"target_id":"user:jane.doe@example.com","entity_ids":["user:jdoe@example.com"]}' \
"${KIBANA_URL}/api/security/entity_store/resolution/link"
Response
All entities in a resolution group must be of the same type.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "Cannot link entities of different types",
"statusCode": 400
}
Request
Console
1 / 2 languages
‹
›
Link two user entities to a target entity, creating a resolution group.
Show more
1
2
3
4
5
6
7
8
POST kbn:/api/security/entity_store/resolution/link
{
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"target_id": "user:jane.doe@example.com"
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"target_id": "user:jane.doe@example.com"
}' \
"${KIBANA_URL}/api/security/entity_store/resolution/link"
Generated from the API spec
Response
The entities were successfully linked to the target entity.
Show more
All entities in a resolution group must be of the same type.
Show more
1
2
3
4
5
6
7
8
9
{
"entity_type": "user",
"linked": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"skipped": [],
"target_id": "user:jane.doe@example.com"
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "Cannot link entities of different types",
"statusCode": 400
}