Unlink entities
Base URL
https://{kibana_url}
POST
/api/security/entity_store/resolution/unlink
POST
/s/{space_id} /api/security/entity_store/resolution/unlink
Auth
Stack
9.4+
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Generally available since 9.4
This functionality is generally available and ready for production usage.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Remove one or more entities from their resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).
Privileges
securitySolution
and
securitySolution-entity-analytics
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
A required header to protect against CSRF attacks
{
}
entity_ids
string [] · min items: 1 · max items: 1000 required
Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000.
200
Indicates a successful response.
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Unlink entities from their resolution group
languages
Request
Console
1 / 2 languages
‹
›
1
2
3
4
POST kbn://api/security/entity_store/resolution/unlink
{
"entity_ids": ["user:jdoe@example.com"]
}
1
2
3
4
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{"entity_ids":["user:jdoe@example.com"]}' \
"${KIBANA_URL}/api/security/entity_store/resolution/unlink"
Response
All entities in a resolution group must be of the same type.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "All entities must be of the same type. Found types: [user, host]",
"statusCode": 400
}
Request
Console
1 / 2 languages
‹
›
Remove entities from their resolution group, restoring them as standalone entities.
Show more
1
2
3
4
5
6
7
POST kbn:/api/security/entity_store/resolution/unlink
{
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
]
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
]
}' \
"${KIBANA_URL}/api/security/entity_store/resolution/unlink"
Generated from the API spec
Response
The entities were successfully removed from their resolution group.
Show more
All entities in a resolution group must be of the same type.
Show more
1
2
3
4
5
6
7
8
{
"entity_type": "user",
"skipped": [],
"unlinked": [
"user:jdoe@example.com",
"user:j.doe@example.com"
]
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "All entities must be of the same type. Found types: [user, host]",
"statusCode": 400
}