Security Entity Analytics API
List all monitored users
Spaces method and path for this operation:
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/list</span></div>Refer to Spaces for more information.
Deprecated in 9.4.0. Use the Watchlists API instead.
Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.
get/api/entity_analytics/monitoring/users/list
Query parameters
kqlstring
KQL query to filter the list of monitored users
Response
List of monitored users