Update an entity

Base URL: https://{kibana_url}

PUT /api/security/entity_store/entities/{entityType}
PUT /s/{space_id}/api/security/entity_store/entities/{entityType}

Auth

Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the force query parameter to true to update protected fields.

Required privileges

Privileges securitySolution

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
entityType enum required: The entity type to update.; Values: user host service generic

Query parameters

force union enum | boolean · default: false: When true, allows updating protected fields.; Values: true false

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

Any of:

@timestamp string · format: date-time · max length: 64: The time the entity record was last updated.
asset object
entity object
event object
labels map string to object: Custom key-value labels attached to the entity.
tags string[]: Tags attached to the entity.
user object: Elastic Common Schema (ECS) user fields collected on the entity.

@timestamp string · format: date-time · max length: 64: The time the entity record was last updated.
asset object
entity object
event object
host object: Elastic Common Schema (ECS) host fields collected on the entity.
labels map string to object: Custom key-value labels attached to the entity.
tags string[]: Tags attached to the entity.

@timestamp string · format: date-time · max length: 64: The time the entity record was last updated.
asset object
entity object
event object
labels map string to object: Custom key-value labels attached to the entity.
service object: Elastic Common Schema (ECS) service fields collected on the entity.
tags string[]: Tags attached to the entity.

@timestamp string · format: date-time · max length: 64: The time the entity record was last updated.
asset object
cloud object: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
entity object
event object
labels map string to object
orchestrator object: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
tags string[]

Responses

200

Indicates the entity was successfully updated.

application/json

400

Bad request.

application/json

404

Entity not found.

application/json