Get risk score history for an entity

Base URL
https://{kibana_url}
  • GET /api/risk_score/history
Auth

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.

Query parameters

entity_type enum required

The type of entity to retrieve history for.

Values: host user service generic
entity_id string · max length: 1000 required

The identifier of the entity to retrieve history for.

from string · max length: 100 · default: now-90d

Start of the time range, in date-math syntax. Defaults to 90 days ago.

to string · max length: 100 · default: now

End of the time range, in date-math syntax. Defaults to now.

score_type enum

Filter entries by the type of score recorded (base, propagated, or resolution).

Values: base propagated resolution
include_contributions boolean · default: false

When true, each entry also includes the contributions recorded for that scoring run (inputs, modifiers, category 2 fields, and criticality_level), when present on the underlying document.

Responses

Successful response

application/json
entity_id string · max length: 1000 required
entity_type enum required
Values: host user service generic
entries object[] required
@timestamp string · format: date-time · max length: 33 required
calculated_level enum required
Values: Unknown Low Moderate High Critical
calculated_score number · format: double
calculated_score_norm number · format: double · min: 0 · max: 100 required
category_1_count integer
category_1_score number · format: double
category_2_count integer
category_2_score number · format: double
criticality_level enum

The criticality level of the asset.

Values: low_impact medium_impact high_impact extreme_impact
score_type enum
Values: base propagated resolution
interval string · max length: 10 required

The effective Elasticsearch date_histogram interval expression the entries were aggregated into (for example 3h, 1d, 1w), derived from the requested time range.

400

Invalid request

Base URL
https://{kibana_url}