Bulk update entities
- Base URL
-
https://{kibana_url}
-
PUT
/api/security/entity_store/entities/bulk
Auth
Update multiple entity records in the Entity Store in a single request.
-
Privileges
securitySolution
-
force
union enum | boolean · default: false
-
When true, allows updating protected fields.
-
Values:
true
false
-
A required header to protect against CSRF attacks
-
entities
object[]
required
-
The entities to update.
-
-
doc
union anyOf
-
Any of:
-
@timestamp
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
The time the entity record was last updated.
-
asset
object
-
-
business_unit
string
-
Business unit the asset belongs to.
-
criticality
enum
nullable
-
The criticality level assigned to this asset.
-
Values:
low_impact
medium_impact
high_impact
extreme_impact
-
environment
string
-
Deployment environment (for example, production, staging).
-
id
string
-
Unique identifier for the asset.
-
model
string
-
Model name or number.
-
name
string
-
Human-readable asset name.
-
owner
string
-
The owner of the asset.
-
serial_number
string
-
Serial number of the asset.
-
vendor
string
-
Vendor or manufacturer.
-
entity
object
-
-
attributes
object
-
Boolean flags describing characteristics of the entity.
-
-
asset
boolean
-
Whether the entity is classified as an asset.
-
known_redirects
string[]
-
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managed
boolean
-
Whether the entity is managed (for example, via a directory service).
-
mfa_enabled
boolean
-
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restriction
string
-
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissions
string[]
-
Action-level permissions granted to this entity (not roles or groups).
-
storage_class
string
-
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlists
string[]
-
Watchlist identifiers the entity belongs to (v2).
-
behaviors
object
-
Behavioral signals observed for the entity.
-
-
anomaly_job_ids
string[]
-
Machine learning anomaly job identifiers (v2).
-
rule_names
string[]
-
Detection rule names that flagged this entity (v2).
-
created_by
string
-
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadata
object
-
-
id
string
-
Unique identifier for this entity.
-
lifecycle
object
-
Timestamps tracking the entity lifecycle.
-
-
first_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was first observed.
-
last_activity
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity last generated activity.
-
last_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was last observed.
-
name
string
-
Human-readable name of the entity.
-
relationships
object
-
Connections between this entity and other entities.
-
-
accesses_frequently
object
-
Entities this entity accesses frequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
accesses_infrequently
object
-
Entities this entity accesses infrequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
administers
object
-
Entities this entity administers (for example, a user who is an admin of a service).
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
communicates_with
object
-
Entities this entity communicates with.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
depends_on
object
-
Entities this entity depends on.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns
object
-
Entities owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns_inferred
object
-
Entities inferred to be owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
resolution
object
-
Resolution metadata linking this entity to another.
-
-
resolved_to
string
-
entity.id of the entity this one resolves to
-
risk
object
-
Aggregated risk score for the resolution group.
-
-
calculated_level
enum
-
Lexical description of the resolution group's aggregated risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the resolution group's aggregated risk score.
-
supervises
object
-
Entities supervised by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
risk
object
-
Risk scoring information for the entity.
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_version
string
-
Schema version of the entity record.
-
source
string[]
-
Sources that produced this entity record.
-
sub_type
string
-
Optional sub-type classification for the entity.
-
type
string
-
The entity type.
-
url
string
-
URL associated with the entity.
-
event
object
-
-
ingested
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the event was ingested into Elasticsearch.
-
labels
map string to object
-
Custom key-value labels attached to the entity.
-
tags
string[]
-
Tags attached to the entity.
-
user
object
-
Elastic Common Schema (ECS) user fields collected on the entity.
-
-
domain
string[]
-
Observed user domains.
-
email
string[]
-
Observed email addresses.
-
full_name
string[]
-
Observed full names of the user.
-
hash
string[]
-
Observed user hashes.
-
id
string[]
-
Observed user identifiers.
-
name
string
-
Primary user name.
-
risk
object
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score.
-
roles
string[]
-
Observed roles assigned to the user.
-
@timestamp
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
The time the entity record was last updated.
-
asset
object
-
-
business_unit
string
-
Business unit the asset belongs to.
-
criticality
enum
nullable
-
The criticality level assigned to this asset.
-
Values:
low_impact
medium_impact
high_impact
extreme_impact
-
environment
string
-
Deployment environment (for example, production, staging).
-
id
string
-
Unique identifier for the asset.
-
model
string
-
Model name or number.
-
name
string
-
Human-readable asset name.
-
owner
string
-
The owner of the asset.
-
serial_number
string
-
Serial number of the asset.
-
vendor
string
-
Vendor or manufacturer.
-
entity
object
-
-
attributes
object
-
Boolean flags describing characteristics of the entity.
-
-
asset
boolean
-
Whether the entity is classified as an asset.
-
known_redirects
string[]
-
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managed
boolean
-
Whether the entity is managed (for example, via a directory service).
-
mfa_enabled
boolean
-
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restriction
string
-
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissions
string[]
-
Action-level permissions granted to this entity (not roles or groups).
-
storage_class
string
-
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlists
string[]
-
Watchlist identifiers the entity belongs to (v2).
-
behaviors
object
-
Behavioral signals observed for the entity.
-
-
anomaly_job_ids
string[]
-
Machine learning anomaly job identifiers (v2).
-
rule_names
string[]
-
Detection rule names that flagged this entity (v2).
-
created_by
string
-
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadata
object
-
-
id
string
-
Unique identifier for this entity.
-
lifecycle
object
-
Timestamps tracking the entity lifecycle.
-
-
first_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was first observed.
-
last_activity
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity last generated activity.
-
last_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was last observed.
-
name
string
-
Human-readable name of the entity.
-
relationships
object
-
Connections between this entity and other entities.
-
-
accesses_frequently
object
-
Entities this entity accesses frequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
accesses_infrequently
object
-
Entities this entity accesses infrequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
administers
object
-
Entities this entity administers (for example, a user who is an admin of a service).
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
communicates_with
object
-
Entities this entity communicates with.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
depends_on
object
-
Entities this entity depends on.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns
object
-
Entities owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns_inferred
object
-
Entities inferred to be owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
resolution
object
-
Resolution metadata linking this entity to another.
-
-
resolved_to
string
-
entity.id of the entity this one resolves to
-
risk
object
-
Aggregated risk score for the resolution group.
-
-
calculated_level
enum
-
Lexical description of the resolution group's aggregated risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the resolution group's aggregated risk score.
-
supervises
object
-
Entities supervised by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
risk
object
-
Risk scoring information for the entity.
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_version
string
-
Schema version of the entity record.
-
source
string[]
-
Sources that produced this entity record.
-
sub_type
string
-
Optional sub-type classification for the entity.
-
type
string
-
The entity type.
-
url
string
-
URL associated with the entity.
-
event
object
-
-
ingested
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the event was ingested into Elasticsearch.
-
host
object
-
Elastic Common Schema (ECS) host fields collected on the entity.
-
-
architecture
string[]
-
Observed CPU architectures.
-
domain
string[]
-
Observed host domains.
-
hostname
string[]
-
Observed hostnames.
-
id
string[]
-
Observed host identifiers.
-
ip
string[]
-
Observed IP addresses.
-
mac
string[]
-
Observed MAC addresses.
-
name
string
-
Primary host name.
-
os
object
-
Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
-
-
name
union string | string[]
-
type
union string | string[]
-
risk
object
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score.
-
type
string[]
-
Observed host types.
-
labels
map string to object
-
Custom key-value labels attached to the entity.
-
tags
string[]
-
Tags attached to the entity.
-
@timestamp
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
The time the entity record was last updated.
-
asset
object
-
-
business_unit
string
-
Business unit the asset belongs to.
-
criticality
enum
nullable
-
The criticality level assigned to this asset.
-
Values:
low_impact
medium_impact
high_impact
extreme_impact
-
environment
string
-
Deployment environment (for example, production, staging).
-
id
string
-
Unique identifier for the asset.
-
model
string
-
Model name or number.
-
name
string
-
Human-readable asset name.
-
owner
string
-
The owner of the asset.
-
serial_number
string
-
Serial number of the asset.
-
vendor
string
-
Vendor or manufacturer.
-
entity
object
-
-
attributes
object
-
Boolean flags describing characteristics of the entity.
-
-
asset
boolean
-
Whether the entity is classified as an asset.
-
known_redirects
string[]
-
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managed
boolean
-
Whether the entity is managed (for example, via a directory service).
-
mfa_enabled
boolean
-
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restriction
string
-
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissions
string[]
-
Action-level permissions granted to this entity (not roles or groups).
-
storage_class
string
-
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlists
string[]
-
Watchlist identifiers the entity belongs to (v2).
-
behaviors
object
-
Behavioral signals observed for the entity.
-
-
anomaly_job_ids
string[]
-
Machine learning anomaly job identifiers (v2).
-
rule_names
string[]
-
Detection rule names that flagged this entity (v2).
-
created_by
string
-
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadata
object
-
-
id
string
-
Unique identifier for this entity.
-
lifecycle
object
-
Timestamps tracking the entity lifecycle.
-
-
first_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was first observed.
-
last_activity
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity last generated activity.
-
last_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was last observed.
-
name
string
-
Human-readable name of the entity.
-
relationships
object
-
Connections between this entity and other entities.
-
-
accesses_frequently
object
-
Entities this entity accesses frequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
accesses_infrequently
object
-
Entities this entity accesses infrequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
administers
object
-
Entities this entity administers (for example, a user who is an admin of a service).
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
communicates_with
object
-
Entities this entity communicates with.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
depends_on
object
-
Entities this entity depends on.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns
object
-
Entities owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns_inferred
object
-
Entities inferred to be owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
resolution
object
-
Resolution metadata linking this entity to another.
-
-
resolved_to
string
-
entity.id of the entity this one resolves to
-
risk
object
-
Aggregated risk score for the resolution group.
-
-
calculated_level
enum
-
Lexical description of the resolution group's aggregated risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the resolution group's aggregated risk score.
-
supervises
object
-
Entities supervised by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
risk
object
-
Risk scoring information for the entity.
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_version
string
-
Schema version of the entity record.
-
source
string[]
-
Sources that produced this entity record.
-
sub_type
string
-
Optional sub-type classification for the entity.
-
type
string
-
The entity type.
-
url
string
-
URL associated with the entity.
-
event
object
-
-
ingested
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the event was ingested into Elasticsearch.
-
labels
map string to object
-
Custom key-value labels attached to the entity.
-
service
object
-
Elastic Common Schema (ECS) service fields collected on the entity.
-
-
address
string
-
Service address.
-
environment
string
-
Service environment (for example, production, staging).
-
ephemeral_id
string
-
Ephemeral identifier of the service.
-
id
string
-
Unique identifier of the service.
-
name
string
-
Primary service name.
-
node
object
-
Node information for the service.
-
-
roles
string[]
-
Node roles.
-
risk
object
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score.
-
state
string
-
Current state of the service.
-
type
string
-
Service type.
-
version
string
-
Service version.
-
tags
string[]
-
Tags attached to the entity.
-
@timestamp
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
The time the entity record was last updated.
-
asset
object
-
-
business_unit
string
-
Business unit the asset belongs to.
-
criticality
enum
nullable
-
The criticality level assigned to this asset.
-
Values:
low_impact
medium_impact
high_impact
extreme_impact
-
environment
string
-
Deployment environment (for example, production, staging).
-
id
string
-
Unique identifier for the asset.
-
model
string
-
Model name or number.
-
name
string
-
Human-readable asset name.
-
owner
string
-
The owner of the asset.
-
serial_number
string
-
Serial number of the asset.
-
vendor
string
-
Vendor or manufacturer.
-
cloud
object
-
Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
-
-
account
object
-
-
instance
object
-
-
machine
object
-
-
project
object
-
-
service
object
-
-
entity
object
-
-
attributes
object
-
Boolean flags describing characteristics of the entity.
-
-
asset
boolean
-
Whether the entity is classified as an asset.
-
known_redirects
string[]
-
Known redirect URIs or URLs (e.g. OAuth application callbacks).
-
managed
boolean
-
Whether the entity is managed (for example, via a directory service).
-
mfa_enabled
boolean
-
Whether multi-factor authentication is enabled for the entity.
-
oauth_consent_restriction
string
-
OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
-
permissions
string[]
-
Action-level permissions granted to this entity (not roles or groups).
-
storage_class
string
-
Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
-
watchlists
string[]
-
Watchlist identifiers the entity belongs to (v2).
-
behaviors
object
-
Behavioral signals observed for the entity.
-
-
anomaly_job_ids
string[]
-
Machine learning anomaly job identifiers (v2).
-
rule_names
string[]
-
Detection rule names that flagged this entity (v2).
-
created_by
string
-
Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
-
EngineMetadata
object
-
-
id
string
-
Unique identifier for this entity.
-
lifecycle
object
-
Timestamps tracking the entity lifecycle.
-
-
first_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was first observed.
-
last_activity
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity last generated activity.
-
last_seen
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
When the entity was last observed.
-
name
string
-
Human-readable name of the entity.
-
relationships
object
-
Connections between this entity and other entities.
-
-
accesses_frequently
object
-
Entities this entity accesses frequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
accesses_infrequently
object
-
Entities this entity accesses infrequently.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
administers
object
-
Entities this entity administers (for example, a user who is an admin of a service).
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
communicates_with
object
-
Entities this entity communicates with.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
depends_on
object
-
Entities this entity depends on.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns
object
-
Entities owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
owns_inferred
object
-
Entities inferred to be owned by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
resolution
object
-
Resolution metadata linking this entity to another.
-
-
resolved_to
string
-
entity.id of the entity this one resolves to
-
risk
object
-
Aggregated risk score for the resolution group.
-
-
calculated_level
enum
-
Lexical description of the resolution group's aggregated risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the resolution group's aggregated risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the resolution group's aggregated risk score.
-
supervises
object
-
Entities supervised by this entity.
-
-
ids
string[]
-
Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
-
raw_identifiers
object
-
-
risk
object
-
Risk scoring information for the entity.
-
-
calculated_level
enum
-
Lexical description of the entity's risk.
-
Values:
Unknown
Low
Moderate
High
Critical
-
calculated_score
number
-
The raw numeric value of the given entity's risk score.
-
calculated_score_norm
number · min: 0 · max: 100
-
The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
-
schema_version
string
-
Schema version of the entity record.
-
source
string[]
-
Sources that produced this entity record.
-
sub_type
string
-
Optional sub-type classification for the entity.
-
type
string
-
The entity type.
-
url
string
-
URL associated with the entity.
-
event
object
-
-
ingested
string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
-
labels
map string to object
-
orchestrator
object
-
Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
-
-
cluster
object
-
-
resource
object
-
-
parent
object
-
-
type
enum
required
-
The entity type of this record.
-
Values:
user
host
service
generic
200
Indicates a successful response.
Thank you for your feedback.