Update the Entity Store
Base URL
https://{kibana_url}
PUT
/api/security/entity_store
Auth
Update the Entity Store log extraction configuration. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the default value.
Privileges
securitySolution
Expand all
A required header to protect against CSRF attacks
200
Indicates a successful response.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Clear log extraction overrides
languages
Update log extraction settings
languages
Request
Console
1 / 2 languages
‹
›
1
2
3
4
5
6
7
8
PUT kbn://api/security/entity_store
{
"logExtraction": {
"lookbackPeriod": "6h",
"frequency": "10m",
"fieldHistoryLength": 15
}
}
1
2
3
4
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"logExtraction":{"lookbackPeriod":"6h","frequency":"10m","fieldHistoryLength":15}}' \
"${KIBANA_URL}/api/security/entity_store"
Response
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
Request
Console
1 / 2 languages
‹
›
Send null for any field to clear that override and revert it to the default value.
Show more
1
2
3
4
5
6
7
PUT kbn:/api/security/entity_store
{
"logExtraction": {
"delay": "null",
"frequency": "null"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"logExtraction": {
"delay": "null",
"frequency": "null"
}
}' \
"${KIBANA_URL}/api/security/entity_store"
Generated from the API spec
Response
The Entity Store configuration was successfully updated.
Show more
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
Request
Console
1 / 2 languages
‹
›
Update the log extraction configuration with a new lookback period and frequency.
Show more
1
2
3
4
5
6
7
8
PUT kbn:/api/security/entity_store
{
"logExtraction": {
"fieldHistoryLength": 15,
"frequency": "10m",
"lookbackPeriod": "6h"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"logExtraction": {
"fieldHistoryLength": 15,
"frequency": "10m",
"lookbackPeriod": "6h"
}
}' \
"${KIBANA_URL}/api/security/entity_store"
Generated from the API spec
Response
The Entity Store configuration was successfully updated.
Show more
A log extraction parameter has an invalid duration format.
Show more
The Entity Store has not been installed yet.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}